5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2

Analysis

max time kernel
95s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe
Size

96KB
MD5

6d4d177c4b389d929f3af6dc16860c6c
SHA1

d036d0061e673cdfe1dd5a9095ca2c07ab669525
SHA256

5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2
SHA512

aa4bfc71487c5eaea2efec1973f115a13f39ea7f229866368b073f1e5f847cc8777f92df50fef133503d74fd5172354fc43dc603250feedf1372eff7f0c70c9a
SSDEEP

1536:qgE0XucRgYClJIElJSs2B7JXrAB1772nzC/UFEEm:qgEOucqlJ7lJduZAB17iu/UFEEm

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2 = "c:\\windows\\5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe -m"	5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe	5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe
File created	\??\c:\windows\5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe	5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
648	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2168	5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe

C:\Users\Admin\AppData\Local\Temp\5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe
"C:\Users\Admin\AppData\Local\Temp\5a0775a8a2b514a7aef796ac0e4005d31f575b00371846cfb9a64bc1fc51b4e2.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...