Overview

overview

7

Static

static

f9c314d548...6a.exe

windows7-x64

3

f9c314d548...6a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    45s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27-10-2022 23:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f9c314d548836ce88850a822b3fe5a6d76dfa32d7f834e5eff3d483263ed8b6a.exe

  • Size

    1.3MB

  • MD5

    fb8f4e417348704b6253085c8e791243

  • SHA1

    ab4a41b0273e147befffa95dec25b460c9b33d3d

  • SHA256

    f9c314d548836ce88850a822b3fe5a6d76dfa32d7f834e5eff3d483263ed8b6a

  • SHA512

    ae52e34f52ad6d2c04d725ce6e50ff4b77b94045bc43cc57c756d337ecf2708521aa5ba14468a28e6a180a1e84af639d03bb0d78d0e9b6ae0c27d4831a1efc94

  • SSDEEP

    24576:2dcFbX3QomAobqkZC4gKa9uKnMRCyGDkpIA9ioGYd17Uk4:bFrQvAxkZC4gKwu3RCykwhAoGYd17Uk4

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9c314d548836ce88850a822b3fe5a6d76dfa32d7f834e5eff3d483263ed8b6a.exe
    "C:\Users\Admin\AppData\Local\Temp\f9c314d548836ce88850a822b3fe5a6d76dfa32d7f834e5eff3d483263ed8b6a.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\f9c314d548836ce88850a822b3fe5a6d76dfa32d7f834e5eff3d483263ed8b6a.exe
      "C:\Users\Admin\AppData\Local\Temp\f9c314d548836ce88850a822b3fe5a6d76dfa32d7f834e5eff3d483263ed8b6a.exe" - 789CE3E6C60EF2B22FA41E7CFED40187343700C48106EC
      2⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1232

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1232-70-0x0000000000000000-mapping.dmp

    Download

  • memory/1232-74-0x0000000002DB0000-0x0000000002E1D000-memory.dmp

    Filesize

    436KB

    Download

  • memory/1232-82-0x0000000003120000-0x00000000031D8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/1232-88-0x0000000000400000-0x00000000006D4000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/1232-90-0x0000000000990000-0x00000000009B9000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1232-93-0x0000000000990000-0x00000000009B9000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1232-94-0x0000000000400000-0x00000000006D4000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/1960-54-0x0000000076181000-0x0000000076183000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1960-56-0x0000000002D90000-0x0000000002DFD000-memory.dmp

    Filesize

    436KB

    Download

  • memory/1960-64-0x0000000003100000-0x00000000031B8000-memory.dmp

    Filesize

    736KB

    Download

  • memory/1960-72-0x0000000000400000-0x00000000006D4000-memory.dmp

    Filesize

    2.8MB

    Download