Analysis

  • max time kernel
    89s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2022 18:40

General

  • Target

    scph39001.mec

  • Size

    4B

  • MD5

    3faf7c064a4984f53e2ef5e80ed543bc

  • SHA1

    3f8affbe07024ccd2f5b8374072d0928c583a862

  • SHA256

    fbbfc6c156266ac7e9afb37f0cc53fb78fadf2f09f580e56b2da57e6539e463b

  • SHA512

    d19a596c9b64033e2735ac7138771d53d02625849a58d88db75d7afcce410f756f4c5e33a61f939e09701fa2b6a7c2a7b3dccdef6843e03b4b9136b71e41bf17

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\scph39001.mec
    1⤵
    • Modifies registry class
    PID:4744
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3796

Network

  • flag-us
    DNS
    164.2.77.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    164.2.77.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    226.101.242.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    226.101.242.52.in-addr.arpa
    IN PTR
    Response
  • 93.184.220.29:80
    322 B
    7
  • 52.242.97.97:443
    260 B
    5
  • 20.42.73.24:443
    322 B
    7
  • 178.79.208.1:80
    322 B
    7
  • 104.80.225.205:443
    322 B
    7
  • 8.8.8.8:53
    164.2.77.40.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    164.2.77.40.in-addr.arpa

  • 8.8.8.8:53
    226.101.242.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    226.101.242.52.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.