Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-05-2022 22:24
Static task
static1
Behavioral task
behavioral1
Sample
0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
-
Size
1022KB
-
MD5
1580c3b5db72184e363d5e8521462109
-
SHA1
c877974a5a9b2e16aa5741b037bce28e798f5d97
-
SHA256
0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b
-
SHA512
65f2ce88166edd7c4dc4a049135d9ffb7133b069847c1a730fc4eead2e14f368adbed22c4369e070c5fb932269d0ceb2daecdc0fc62b4bd06b67a89016643dd8
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exepid process 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exepid process 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exepid process 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exedescription pid process target process PID 1660 wrote to memory of 1924 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1924 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1924 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1924 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1944 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1944 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1944 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1944 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1724 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1724 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1724 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 1724 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 996 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 996 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 996 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 996 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 956 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 956 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 956 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 956 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 2004 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 2004 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 2004 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe PID 1660 wrote to memory of 2004 1660 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe 0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1660-54-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB