Overview
overview
9Static
static
9APT-Hunter...er.pdf
windows7_x64
1APT-Hunter...er.pdf
windows10-2004_x64
1APT-Hunter...er.vbs
windows7_x64
1APT-Hunter...er.vbs
windows10-2004_x64
1APT-Hunter...er.exe
windows7_x64
1APT-Hunter...er.exe
windows10-2004_x64
1APT-Hunter...er.exe
windows7_x64
1APT-Hunter...er.exe
windows10-2004_x64
1APT-Hunter...se.exe
windows7_x64
1APT-Hunter...se.exe
windows10-2004_x64
1APT-Hunter...24.dll
windows7_x64
8APT-Hunter...24.dll
windows10-2004_x64
8APT-Hunter...fc.exe
windows7_x64
1APT-Hunter...fc.exe
windows10-2004_x64
1APT-Hunter...ile.pl
windows7_x64
3APT-Hunter...ile.pl
windows10-2004_x64
3APT-Hunter...rse.pl
windows7_x64
3APT-Hunter...rse.pl
windows10-2004_x64
3APT-Hunter...rpt.pl
windows7_x64
3APT-Hunter...rpt.pl
windows10-2004_x64
3APT-Hunter...rse.pl
windows7_x64
3APT-Hunter...rse.pl
windows10-2004_x64
3APT-Hunter...rse.pl
windows7_x64
3APT-Hunter...rse.pl
windows10-2004_x64
3APT-Hunter...idx.pl
windows7_x64
3APT-Hunter...idx.pl
windows10-2004_x64
3APT-Hunter.../jl.pl
windows7_x64
3APT-Hunter.../jl.pl
windows10-2004_x64
3APT-Hunter...rse.pl
windows7_x64
3APT-Hunter...rse.pl
windows10-2004_x64
3APT-Hunter...lnk.pl
windows7_x64
3APT-Hunter...lnk.pl
windows10-2004_x64
3Analysis
-
max time kernel
137s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
27-05-2022 20:21
Behavioral task
behavioral1
Sample
APT-Hunter-master/APTHunter.pdf
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
APT-Hunter-master/APTHunter.pdf
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
APT-Hunter-master/APT_Hunter.vbs
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
APT-Hunter-master/APT_Hunter.vbs
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
APT-Hunter-master/Tools/AmCacheParser/AmcacheParser.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
APT-Hunter-master/Tools/AmCacheParser/AmcacheParser.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
APT-Hunter-master/Tools/AppCompatCacheParser/AppCompatCacheParser.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
APT-Hunter-master/Tools/AppCompatCacheParser/AppCompatCacheParser.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
APT-Hunter-master/Tools/HCTOOLS/jobparse.exe
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
APT-Hunter-master/Tools/HCTOOLS/jobparse.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
APT-Hunter-master/Tools/HCTOOLS/p2x5124.dll
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
APT-Hunter-master/Tools/HCTOOLS/p2x5124.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
APT-Hunter-master/Tools/HCTOOLS/rfc.exe
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
APT-Hunter-master/Tools/HCTOOLS/rfc.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
APT-Hunter-master/Tools/HCTOOLS/source/bodyfile.pl
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
APT-Hunter-master/Tools/HCTOOLS/source/bodyfile.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
APT-Hunter-master/Tools/HCTOOLS/source/evtparse.pl
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
APT-Hunter-master/Tools/HCTOOLS/source/evtparse.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
APT-Hunter-master/Tools/HCTOOLS/source/evtrpt.pl
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
APT-Hunter-master/Tools/HCTOOLS/source/evtrpt.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
APT-Hunter-master/Tools/HCTOOLS/source/evtxparse.pl
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
APT-Hunter-master/Tools/HCTOOLS/source/evtxparse.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
APT-Hunter-master/Tools/HCTOOLS/source/ftkparse.pl
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
APT-Hunter-master/Tools/HCTOOLS/source/ftkparse.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
APT-Hunter-master/Tools/HCTOOLS/source/idx.pl
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
APT-Hunter-master/Tools/HCTOOLS/source/idx.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral27
Sample
APT-Hunter-master/Tools/HCTOOLS/source/jl.pl
Resource
win7-20220414-en
Behavioral task
behavioral28
Sample
APT-Hunter-master/Tools/HCTOOLS/source/jl.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral29
Sample
APT-Hunter-master/Tools/HCTOOLS/source/jobparse.pl
Resource
win7-20220414-en
Behavioral task
behavioral30
Sample
APT-Hunter-master/Tools/HCTOOLS/source/jobparse.pl
Resource
win10v2004-20220414-en
Behavioral task
behavioral31
Sample
APT-Hunter-master/Tools/HCTOOLS/source/lnk.pl
Resource
win7-20220414-en
Behavioral task
behavioral32
Sample
APT-Hunter-master/Tools/HCTOOLS/source/lnk.pl
Resource
win10v2004-20220414-en
General
-
Target
APT-Hunter-master/Tools/HCTOOLS/source/jl.pl
-
Size
2KB
-
MD5
b54aff6fa7a01f709a3340ac62817c00
-
SHA1
41df8ace28794558effbbfb83901a97ed6448ebe
-
SHA256
922643dfbdea3a689b449d57228b82bd87dee02e3508fcd1762def9af4304c0b
-
SHA512
479338c2ba75b74a259ca30e97deae87bc601b70ca8cfaeab88d917e7b98fec740716279c889f4f7a955b36b8c814de55d1329119ecc45b9a8a73264994b5cb4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3568 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\APT-Hunter-master\Tools\HCTOOLS\source\jl.pl1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx