Analysis

  • max time kernel
    151s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 15:36

General

  • Target

    35a0460b2393be4815629c1a8b4f78a422b5a9cad0708136b730fdd2b9ea6442.exe

  • Size

    176KB

  • MD5

    348762092bc9abda67b6c23400227160

  • SHA1

    aa5d2023759c4350db0936263176d58d818c2aaa

  • SHA256

    35a0460b2393be4815629c1a8b4f78a422b5a9cad0708136b730fdd2b9ea6442

  • SHA512

    2c64db8b89d587ea7d45e716814c2d6fb67cb2904cf92a983e93b2c18180ca940af8e82f7bb6c7ad1348255d8611edd2989e1bc562faa10bcd5efb88b18bd4c6

  • SSDEEP

    3072:yZrHtNHLk2URFGAJb4O3JDmSufeHcpF3eKatFyK/fObT/bGiyrDmwBWbrVELTiBx:oBN3URMAJb4O3JDm9feHcpF3DjK/fObF

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 54 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35a0460b2393be4815629c1a8b4f78a422b5a9cad0708136b730fdd2b9ea6442.exe
    "C:\Users\Admin\AppData\Local\Temp\35a0460b2393be4815629c1a8b4f78a422b5a9cad0708136b730fdd2b9ea6442.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\tuijik.exe
      "C:\Users\Admin\tuijik.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1728

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\tuijik.exe

    Filesize

    176KB

    MD5

    d52abe3b4b0550ca149ad1c5c1d688b5

    SHA1

    322369d1b73d59d41101ed81e0c02831d4dbe101

    SHA256

    3e4ff9a65c15deba852e1a49b7d76704aa6e8ace2575f46f2bff12f1817a4ddf

    SHA512

    c21d3a3234e574aede7607ba107ab38f13762dec9202838b05479530694c3f551c903b84cc1457f96677c6a76d22241ae3574941691dd85a77ddfd6a8f898c4c

  • C:\Users\Admin\tuijik.exe

    Filesize

    176KB

    MD5

    d52abe3b4b0550ca149ad1c5c1d688b5

    SHA1

    322369d1b73d59d41101ed81e0c02831d4dbe101

    SHA256

    3e4ff9a65c15deba852e1a49b7d76704aa6e8ace2575f46f2bff12f1817a4ddf

    SHA512

    c21d3a3234e574aede7607ba107ab38f13762dec9202838b05479530694c3f551c903b84cc1457f96677c6a76d22241ae3574941691dd85a77ddfd6a8f898c4c

  • \Users\Admin\tuijik.exe

    Filesize

    176KB

    MD5

    d52abe3b4b0550ca149ad1c5c1d688b5

    SHA1

    322369d1b73d59d41101ed81e0c02831d4dbe101

    SHA256

    3e4ff9a65c15deba852e1a49b7d76704aa6e8ace2575f46f2bff12f1817a4ddf

    SHA512

    c21d3a3234e574aede7607ba107ab38f13762dec9202838b05479530694c3f551c903b84cc1457f96677c6a76d22241ae3574941691dd85a77ddfd6a8f898c4c

  • \Users\Admin\tuijik.exe

    Filesize

    176KB

    MD5

    d52abe3b4b0550ca149ad1c5c1d688b5

    SHA1

    322369d1b73d59d41101ed81e0c02831d4dbe101

    SHA256

    3e4ff9a65c15deba852e1a49b7d76704aa6e8ace2575f46f2bff12f1817a4ddf

    SHA512

    c21d3a3234e574aede7607ba107ab38f13762dec9202838b05479530694c3f551c903b84cc1457f96677c6a76d22241ae3574941691dd85a77ddfd6a8f898c4c

  • memory/1476-56-0x0000000075E51000-0x0000000075E53000-memory.dmp

    Filesize

    8KB