Overview
overview
10Static
static
ts.zip
windows7-x64
1ts.zip
windows10-2004-x64
1Install.exe
windows7-x64
10Install.exe
windows10-2004-x64
10advapi32res.dll
windows7-x64
1advapi32res.dll
windows10-2004-x64
1fonts/Alakob.ttf
windows7-x64
3fonts/Alakob.ttf
windows10-2004-x64
7fonts/Alas...ts.ttf
windows7-x64
3fonts/Alas...ts.ttf
windows10-2004-x64
7fonts/Arggotsc.ttf
windows7-x64
3fonts/Arggotsc.ttf
windows10-2004-x64
7fonts/Army...ed.ttf
windows7-x64
3fonts/Army...ed.ttf
windows10-2004-x64
7fonts/Army Thin.ttf
windows7-x64
3fonts/Army Thin.ttf
windows10-2004-x64
7fonts/BELL.ttf
windows7-x64
3fonts/BELL.ttf
windows10-2004-x64
7fonts/BELLB.ttf
windows7-x64
3fonts/BELLB.ttf
windows10-2004-x64
7fonts/BELLI.ttf
windows7-x64
3fonts/BELLI.ttf
windows10-2004-x64
7fonts/BOD_BI.ttf
windows7-x64
3fonts/BOD_BI.ttf
windows10-2004-x64
7fonts/BOD_BLAI.ttf
windows7-x64
3fonts/BOD_BLAI.ttf
windows10-2004-x64
7fonts/BOD_I.ttf
windows7-x64
3fonts/BOD_I.ttf
windows10-2004-x64
7fonts/CALISTB.ttf
windows7-x64
3fonts/CALISTB.ttf
windows10-2004-x64
7fonts/CALISTBI.ttf
windows7-x64
3fonts/CALISTBI.ttf
windows10-2004-x64
7Analysis
-
max time kernel
35s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14/09/2022, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
ts.zip
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ts.zip
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
Install.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Install.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
advapi32res.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
advapi32res.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
fonts/Alakob.ttf
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
fonts/Alakob.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
fonts/AlaskanNights.ttf
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
fonts/AlaskanNights.ttf
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
fonts/Arggotsc.ttf
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
fonts/Arggotsc.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
fonts/Army Condensed.ttf
Resource
win7-20220901-en
Behavioral task
behavioral14
Sample
fonts/Army Condensed.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
fonts/Army Thin.ttf
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
fonts/Army Thin.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
fonts/BELL.ttf
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
fonts/BELL.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
fonts/BELLB.ttf
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
fonts/BELLB.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
fonts/BELLI.ttf
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
fonts/BELLI.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
fonts/BOD_BI.ttf
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
fonts/BOD_BI.ttf
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
fonts/BOD_BLAI.ttf
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
fonts/BOD_BLAI.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
fonts/BOD_I.ttf
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
fonts/BOD_I.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
fonts/CALISTB.ttf
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
fonts/CALISTB.ttf
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
fonts/CALISTBI.ttf
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
fonts/CALISTBI.ttf
Resource
win10v2004-20220812-en
General
-
Target
fonts/BOD_BI.ttf
-
Size
83KB
-
MD5
5bb67e55de4ee82aff5585b7bc7df099
-
SHA1
30c29ebba4511f7ffb96bc056bfb6531229011f4
-
SHA256
9729e2ae73b15871db606a18a48b8674ce2bae35d76a511d3510c4a9db2385ef
-
SHA512
51e91ff81bf05e2cd05d0caaf81f8ce6742d7ef9b8f7857daad2bbad085f419d6773c1bd664f040bf0028f51139046bb23589c1c66c3c4065dfd34d246c64c84
-
SSDEEP
1536:j0mROXFT8UwUDH49fe7/jtYMXVT4FBMDbsJ4/RG2luywo60qdlnHy721Mslt6l2G:wnXp8UwUDY9fC0gTqy4DnSK1MsN9uELO
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1468 2020 cmd.exe 29 PID 2020 wrote to memory of 1468 2020 cmd.exe 29 PID 2020 wrote to memory of 1468 2020 cmd.exe 29