Overview
overview
10Static
static
1078769e4085...7e.zip
windows7_x64
178769e4085...7e.zip
windows10-2004_x64
malware-an...er.pdf
windows7_x64
1malware-an...er.pdf
windows10-2004_x64
1malware-an...is.pdf
windows7_x64
1malware-an...is.pdf
windows10-2004_x64
1malware-an...ypt.py
linux_amd64
malware-an...ypt.py
linux_armhf
malware-an...ypt.py
linux_mips
malware-an...ypt.py
linux_mipsel
malware-an...ons.py
windows7_x64
3malware-an...ons.py
windows10-2004_x64
3malware-an...is.pdf
windows7_x64
1malware-an...is.pdf
windows10-2004_x64
malware-an...tt.ps1
windows7_x64
10malware-an...tt.ps1
windows10-2004_x64
8malware-an...tt.vbs
windows7_x64
malware-an...tt.vbs
windows10-2004_x64
7malware-an...er.ps1
windows7_x64
1malware-an...er.ps1
windows10-2004_x64
malware-an...od.ps1
windows7_x64
malware-an...od.ps1
windows10-2004_x64
10malware-an...44.exe
windows7_x64
10malware-an...44.exe
windows10-2004_x64
malware-an...55.dll
windows7_x64
1malware-an...55.dll
windows10-2004_x64
malware-an...xes.py
linux_amd64
malware-an...xes.py
linux_armhf
malware-an...xes.py
linux_mips
malware-an...xes.py
linux_mipsel
malware-an...dra.py
windows7_x64
malware-an...dra.py
windows10-2004_x64
3Analysis
-
max time kernel
106s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:11
Static task
static1
Behavioral task
behavioral1
Sample
78769e4085312f21cc67e77bfdd136f9a30d34e2d2a5d8870f2ebbeb7c3a8f7e.zip
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
78769e4085312f21cc67e77bfdd136f9a30d34e2d2a5d8870f2ebbeb7c3a8f7e.zip
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
malware-analysis-writeups-master/agent-tesla-loader/agentTeslaLoader.pdf
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
malware-analysis-writeups-master/agent-tesla-loader/agentTeslaLoader.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
malware-analysis-writeups-master/ava-maria-rat/AvaMariaAnalysis.pdf
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
malware-analysis-writeups-master/ava-maria-rat/AvaMariaAnalysis.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral8
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral9
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral10
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerBeaconDecrypt.py
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral11
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerCatchBeacons.py
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
malware-analysis-writeups-master/ava-maria-rat/helperScripts/buerCatchBeacons.py
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
malware-analysis-writeups-master/bashar-bachir-chain/bashar-bachir-analysis.pdf
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
malware-analysis-writeups-master/bashar-bachir-chain/bashar-bachir-analysis.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.ps1
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.vbs
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/avastt.vbs
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/downloader.ps1
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/downloader.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod.ps1
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod.ps1
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli444.exe
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli444.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli555.dll
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
malware-analysis-writeups-master/bashar-bachir-chain/files/nod_Cli555.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
ubuntu1804-amd64-en-20211208
Behavioral task
behavioral28
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral29
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-mipsbe-en-20211208
Behavioral task
behavioral30
Sample
malware-analysis-writeups-master/bashar-bachir-chain/helperScripts/extractNodExes.py
Resource
debian9-mipsel-en-20211208
Behavioral task
behavioral31
Sample
malware-analysis-writeups-master/razy-variant/razyVariantDecryptStackStrings_ghidra.py
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
malware-analysis-writeups-master/razy-variant/razyVariantDecryptStackStrings_ghidra.py
Resource
win10v2004-20220414-en
General
-
Target
malware-analysis-writeups-master/razy-variant/razyVariantDecryptStackStrings_ghidra.py
-
Size
3KB
-
MD5
dff77679ed7ca91d5ed75be8162bd0b3
-
SHA1
47b22f8b9db98a91d6fcb26f66a82fc6c826b81e
-
SHA256
2d916994f6014273de59f89f2399c2f9f1d153fbc976fc7e87925a572f13a468
-
SHA512
66993c87187a326e6f05ceaf399c67d3feddbd4f59d220e759d405241f93f6b7258c86c3f687b27d5453605042b048f119796e658c3ddda4bfb70993d1544ee3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3276 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\malware-analysis-writeups-master\razy-variant\razyVariantDecryptStackStrings_ghidra.py1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx