Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
resource tags
arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system -
submitted
18-07-2022 14:36
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetect.malware2.27510.exe
Resource
win7-20220414-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetect.malware2.27510.exe
Resource
win10v2004-20220414-en
3 signatures
150 seconds
General
-
Target
SecuriteInfo.com.W32.AIDetect.malware2.27510.exe
-
Size
1.4MB
-
MD5
25345e3d806b7f3f0c96344ee09930c4
-
SHA1
afd9f60c2542f16a5d03a068e80fbbdefd519fca
-
SHA256
e3818c229b45e08ca6423d9942f7a1135270fe28eedb5adeb419e7473f288001
-
SHA512
a54b1fcadd5c50b9c37482b8e82e3a6cc31cc04d8cf7a0436aa749c1db1837361e914a587bc45c313498d34461c3b5466ba73313d4951a5c3da208c90e1b7a5d
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
SecuriteInfo.com.W32.AIDetect.malware2.27510.exepid process 1556 SecuriteInfo.com.W32.AIDetect.malware2.27510.exe 1556 SecuriteInfo.com.W32.AIDetect.malware2.27510.exe 1556 SecuriteInfo.com.W32.AIDetect.malware2.27510.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
SecuriteInfo.com.W32.AIDetect.malware2.27510.exedescription pid process target process PID 1556 wrote to memory of 1504 1556 SecuriteInfo.com.W32.AIDetect.malware2.27510.exe cmd.exe PID 1556 wrote to memory of 1504 1556 SecuriteInfo.com.W32.AIDetect.malware2.27510.exe cmd.exe PID 1556 wrote to memory of 1504 1556 SecuriteInfo.com.W32.AIDetect.malware2.27510.exe cmd.exe PID 1556 wrote to memory of 1504 1556 SecuriteInfo.com.W32.AIDetect.malware2.27510.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.27510.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.27510.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:1504