Overview

overview

8

Static

static

SQ22201004...03.exe

windows7-x64

8

SQ22201004...03.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2022, 21:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SQ22201004 S0Q22201003.exe
  • Size 423KB
  • Sample221012-1srkdsebb4
  • SHA256 d476dd03b89f907816cb87f2182926791494de65269e1b82356c61a7350e1fad
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SQ22201004 S0Q22201003.exe
    "C:\Users\Admin\AppData\Local\Temp\SQ22201004 S0Q22201003.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
      "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1080
      • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:548

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        jieuotbgvwf.gk
        • Path C:\Users\Admin\AppData\Local\Temp\jieuotbgvwf.gk
        • Size 4KB
        • SHA256 ed660ac8bead65e2fd9edf434988caa9be12967238cd85230dfaa0153f21c50f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        uimrbvfxzq.n
        • Path C:\Users\Admin\AppData\Local\Temp\uimrbvfxzq.n
        • Size 476KB
        • SHA256 828bd67a1409f41078abafe06efea7a7981c7cad8c89d18e082b9e7b551c8def
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path \Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path \Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path \Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1720-54-0x00000000757A1000-0x00000000757A3000-memory.dmp
        Download