Analysis
-
max time kernel
151s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
11/10/2022, 17:58
General
-
Target
9bb6444888650ee94fc048c9dc6cd3b3cc01b2a0331407c3cd068a19618acebd.exe
-
Size
842KB
-
MD5
7bd0168fe3456a9d72270d1818d26252
-
SHA1
06df0bc1cf3c77dd3736c2d88925e87b016bd80f
-
SHA256
9bb6444888650ee94fc048c9dc6cd3b3cc01b2a0331407c3cd068a19618acebd
-
SHA512
7278a8bc3c39d7eb0a2e4b818967a51e9b5b7761b9520278f1b0ce548bde7f04b13b6904a527cf4dad1ef07fb6f6921088d6a4a3300fbf63418878b230e20970
-
SSDEEP
12288:GsOvjPKfPdNwzzuN3zXJgAtC9ysYHY6dHdQWZBUvK+Sl6TDu/tDI+viMVkDNAcKI:G9vjM3NLJNoWxHd/cK+SgaJNaM05D
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of SendNotifyMessage 12 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb6444888650ee94fc048c9dc6cd3b3cc01b2a0331407c3cd068a19618acebd.exe"C:\Users\Admin\AppData\Local\Temp\9bb6444888650ee94fc048c9dc6cd3b3cc01b2a0331407c3cd068a19618acebd.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\midefender.exeC:\ProgramData\midefender.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD59c0658d88c420b52fa1652c9fb6b4a9a
SHA152c71b9f0b5f0596ad8045f62d75cfda5d1bcb34
SHA256bfbc03f8559685eb53ad4d25a0de70f66b4c7f5db790cae996277409dfbfdf06
SHA512957eb63a2cd6799878522f8cad050c836369bf71c4481a5b2079db0689bff898fb9d6622d0d48f10295b6ceb2c9383f53903374a97c8f4f2e311da7989e3506a
-
Filesize
820KB
MD59c0658d88c420b52fa1652c9fb6b4a9a
SHA152c71b9f0b5f0596ad8045f62d75cfda5d1bcb34
SHA256bfbc03f8559685eb53ad4d25a0de70f66b4c7f5db790cae996277409dfbfdf06
SHA512957eb63a2cd6799878522f8cad050c836369bf71c4481a5b2079db0689bff898fb9d6622d0d48f10295b6ceb2c9383f53903374a97c8f4f2e311da7989e3506a
-
Filesize
820KB
MD59c0658d88c420b52fa1652c9fb6b4a9a
SHA152c71b9f0b5f0596ad8045f62d75cfda5d1bcb34
SHA256bfbc03f8559685eb53ad4d25a0de70f66b4c7f5db790cae996277409dfbfdf06
SHA512957eb63a2cd6799878522f8cad050c836369bf71c4481a5b2079db0689bff898fb9d6622d0d48f10295b6ceb2c9383f53903374a97c8f4f2e311da7989e3506a
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
8KB
-
Filesize
6.0MB
-
Filesize
64KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB