Analysis
-
max time kernel
61s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
30/09/2022, 21:09
General
-
Target
00306bb314bcfa2df938f3eabee519a0705616a9028e06e418ee5d9adcd8ed85.exe
-
Size
5.6MB
-
MD5
bd01c7db1436b555621e1f2dadb87b25
-
SHA1
e80e31c68582586a26ca2f4e68c11f51dcefe534
-
SHA256
00306bb314bcfa2df938f3eabee519a0705616a9028e06e418ee5d9adcd8ed85
-
SHA512
3e0087ffa06672eb67f39fda5a581791c4a1c37853f6dba120b0d989244bbaacbe33141951f498cc99e7f27094503d016229fb64d582850656a9b83213119026
-
SSDEEP
49152:I2u9tiDDcv2pDAir2AtweQXuzVwHxEIMmOPTIPOvs1aQEHuSaOnmYApmcjb:9u9wN59r29eXBYxEIusGvs4Q5SaO
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00306bb314bcfa2df938f3eabee519a0705616a9028e06e418ee5d9adcd8ed85.exe"C:\Users\Admin\AppData\Local\Temp\00306bb314bcfa2df938f3eabee519a0705616a9028e06e418ee5d9adcd8ed85.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
204KB