Overview

overview

8

Static

static

HEUR-Troja...bf.exe

windows7-x64

8

HEUR-Troja...bf.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    114s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-09-2022 09:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe

  • Size

    179KB

  • MD5

    61fccc142e2bbf498885bb6e42bae62c

  • SHA1

    7f15507c7798d8b99696c19929c86c6c629eb2f5

  • SHA256

    ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf

  • SHA512

    a3cc95a442581d02c97d4fe48494b157f37e5dff4ddf175723a2c99e442492370ad65f9f22da29ffd020754445193215b7dadc3515ab8cee91b6dd3b1f1202b1

  • SSDEEP

    3072:yX7iPbPtN614Kej7QsyuEnQACE+6GJTOr/q+i5fAQXGfiPbPtN6144iPbPtN614V:y7Ity4KejEswQAxK+ilAQXGfIty44Itq

Score
8/10
ransomwarespywarestealer

Malware Config

Signatures

  • Modifies extensions of user files 10 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Encoder.gen-ae91da58a702252cc0dabcf19fa65e9655c7b7143e71e048aad1ebe59a31aabf.exe"
    1⤵
    • Modifies extensions of user files
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1688
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1604

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1688-54-0x0000000000010000-0x0000000000042000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1688-55-0x000007FEFB731000-0x000007FEFB733000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1688-56-0x000000001AF66000-0x000000001AF85000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1688-57-0x0000000024FF0000-0x0000000025796000-memory.dmp
    Filesize

    7.6MB

    Download