09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791

Analysis

max time kernel
30s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 21:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe
Size

20KB
MD5

33eccb00a0900d4e3c95514ea15839e1
SHA1

fd1d8f6b770f6f29386a979f7b52e9d3710553f3
SHA256

09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791
SHA512

66bb39c5a518b1332bc0de27f0359533a50ba0d62c81bb0151ab4adcf40c3ee5865a1400013b8cee4c94b243a3124ba9834deefd7f76b422ed0e4dd4ac94514c
SSDEEP

384:THzexySXF2FENfGzB5AJiQiFeiKi6iP8WZNW/:TTexyCFh6BHVpTju

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.exe	09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.exe	09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Recycled\desktop.ini	09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe
File created	C:\Recycled\desktop.ini	09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe
File created	C:\autorun.inf	09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
960	09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe

C:\Users\Admin\AppData\Local\Temp\09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe
"C:\Users\Admin\AppData\Local\Temp\09e169bc05e6774865db9edd40f9c791b917575a37ad182ffd528205dcecf791.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Suspicious use of SetWindowsHookEx
PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/960-54-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/960-55-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/960-58-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/960-60-0x0000000073DA1000-0x0000000073DA3000-memory.dmp

Filesize
8KB

Download
memory/960-61-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads