Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 16:45
Static task
static1
Behavioral task
behavioral1
Sample
407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe
Resource
win10v2004-20220414-en
General
-
Target
407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe
-
Size
1.1MB
-
MD5
cd611e1f87a03308cd78e3d00643cc69
-
SHA1
b152637db3b0630b00c223bb9a65eaa2edeba2ce
-
SHA256
407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544
-
SHA512
17df753c03bb63696c76c11dfd0901d85510b99e9c312bbc042f04b501b432377ce8d1749768eabeafac2af289cf52722648c2375fef81ee1fc2e40551a16512
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 536 set thread context of 1756 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe 28 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 536 wrote to memory of 1756 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe 28 PID 536 wrote to memory of 1756 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe 28 PID 536 wrote to memory of 1756 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe 28 PID 536 wrote to memory of 1756 536 407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe"C:\Users\Admin\AppData\Local\Temp\407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe"C:\Users\Admin\AppData\Local\Temp\407e3a7893464719061c167066b9c6955a73a1f58281ab9b55323bbb123a0544.exe"2⤵PID:1756
-