Analysis
-
max time kernel
127s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29-09-2022 12:38
General
-
Target
Trojan-Ransom.Win32.Zerber.gdcz-f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.exe
-
Size
149KB
-
MD5
7d8f0e539e50eb545d094c50aab0ea9e
-
SHA1
9368da690ace5328abc4461cd8322d78c1fdc290
-
SHA256
f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9
-
SHA512
092d05eb357da75c2a6646a353e1c1cf7f0ae66ea32ac4beff8fda87160c9226417b187b4ac34e7b5745aaa65c8a6b8b33b9f02e19d9a959627544b50a3eae7a
-
SSDEEP
3072:Pmpq7ybSPGccu5R9Wl7rSmpVYc7+DUltw/ArIW1:epqG2eM5R9kNj2UlgJ
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Zerber.gdcz-f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.exe"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Zerber.gdcz-f9c5420c0f039a178f5495ecfb657f8da383624e0cf7f02c645fbdfa95e2e8b9.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
-
Filesize
88KB
-
Filesize
24KB
-
Filesize
224KB