Overview

overview

8

Static

static

SQ22201004...03.exe

windows7-x64

8

SQ22201004...03.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    153s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2022, 21:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SQ22201004 S0Q22201003.exe
  • Size 423KB
  • Sample221012-1srkdsebb4
  • SHA256 d476dd03b89f907816cb87f2182926791494de65269e1b82356c61a7350e1fad
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SQ22201004 S0Q22201003.exe
    "C:\Users\Admin\AppData\Local\Temp\SQ22201004 S0Q22201003.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
      "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
        3⤵
        • Executes dropped EXE
        PID:3628
      • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
        3⤵
        • Executes dropped EXE
        PID:4400
      • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
        3⤵
        • Executes dropped EXE
        PID:4468
      • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4220
      • C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        "C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2304

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        jieuotbgvwf.gk
        • Path C:\Users\Admin\AppData\Local\Temp\jieuotbgvwf.gk
        • Size 4KB
        • SHA256 ed660ac8bead65e2fd9edf434988caa9be12967238cd85230dfaa0153f21c50f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ptjtmdqqd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\ptjtmdqqd.exe
        • Size 6KB
        • SHA256 79c78fe05a3f8f4c4879ab8c9fd2e522743e136a9358aa58c9755efd3abb89f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        uimrbvfxzq.n
        • Path C:\Users\Admin\AppData\Local\Temp\uimrbvfxzq.n
        • Size 476KB
        • SHA256 828bd67a1409f41078abafe06efea7a7981c7cad8c89d18e082b9e7b551c8def
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download