Analysis

  • max time kernel
    42s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 00:40 UTC

General

  • Target

    2fd90be05aee0e3e9712196e5656fcf551c4c6a655e3f215ce466b421611640c.exe

  • Size

    206KB

  • MD5

    2eab6e3f8cda158fe21e854f9c2c3420

  • SHA1

    4d133fa79988392a00428e836bb8542aed213b14

  • SHA256

    2fd90be05aee0e3e9712196e5656fcf551c4c6a655e3f215ce466b421611640c

  • SHA512

    c798c8bce2b6912d2b9c8d12abd04389f7ce3c55f74a80270c4c5e154fcf4edd3bfbddb8f29980e42e580096196304f7cbbd5c08fd972cc341cd47d3a3490b76

  • SSDEEP

    3072:+dqI+Xr1tXwt85ZCZD0aEoWLBAmyUxEJ9cWYpDeCFDxp0:+/gfXwt85ZCZD0jLBAmyUxKcWY3F70

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fd90be05aee0e3e9712196e5656fcf551c4c6a655e3f215ce466b421611640c.exe
    "C:\Users\Admin\AppData\Local\Temp\2fd90be05aee0e3e9712196e5656fcf551c4c6a655e3f215ce466b421611640c.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • \??\c:\windows\SysWOW64\explorer.exe
      c:\windows\system32\explorer.exe
      2⤵
        PID:2020

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2020-60-0x0000000074EE1000-0x0000000074EE3000-memory.dmp

      Filesize

      8KB

    • memory/2032-57-0x0000000075A71000-0x0000000075A73000-memory.dmp

      Filesize

      8KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.