Analysis
-
max time kernel
152s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/10/2022, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe
-
Size
48KB
-
MD5
0ab16a4dc494950bbd3bdb1407981a69
-
SHA1
6f1e6e9d72714b0e10aa15ed4178207dfc8004b3
-
SHA256
6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc
-
SHA512
7e7037c44d0d91d1137d2bca09a8c9616fb1d0e129692057908ca01733d4e2c310fc585a58ebfc58c13506793d7f94a3e3305d4e756b5a22635d0aca1bbd986b
-
SSDEEP
768:Q4JipFA13weNFSmOEgkqLuTGPiuBe+Tnc/9/8IZnS0R0TYWfHenHLqHCTHgpQO0k:zsA1geNFSvEstRe+Tnsx5S0REQO0k
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ktper.exe -
Executes dropped EXE 1 IoCs
pid Process 1112 ktper.exe -
Loads dropped DLL 2 IoCs
pid Process 1848 6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe 1848 6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ktper.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ktper = "C:\\Users\\Admin\\ktper.exe" ktper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe 1112 ktper.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1848 6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe 1112 ktper.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1112 1848 6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe 28 PID 1848 wrote to memory of 1112 1848 6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe 28 PID 1848 wrote to memory of 1112 1848 6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe 28 PID 1848 wrote to memory of 1112 1848 6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe 28 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18 PID 1112 wrote to memory of 1848 1112 ktper.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe"C:\Users\Admin\AppData\Local\Temp\6abdd9a64c30557787d77ec08f1c6eceb4d212c4817c1ca85ea6a6757d1ee3bc.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\ktper.exe"C:\Users\Admin\ktper.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD582b0b3e846bfb6444b9afebf9e5f1384
SHA1157e972fc30185df09db1780dbee3733d71a37b8
SHA25627b53affa6a064d1b94b9bcb8b1dbb50b8d776799da6704a44eddd5cfb161c8a
SHA512af315baa285c672a00583174f19ea888764476ce59ca89ade5dd24382c9912b89167cd01dd53dbe5cd23dbf747d2de2c10f5e5fad035df5a55d0a0e57c7b303f
-
Filesize
48KB
MD582b0b3e846bfb6444b9afebf9e5f1384
SHA1157e972fc30185df09db1780dbee3733d71a37b8
SHA25627b53affa6a064d1b94b9bcb8b1dbb50b8d776799da6704a44eddd5cfb161c8a
SHA512af315baa285c672a00583174f19ea888764476ce59ca89ade5dd24382c9912b89167cd01dd53dbe5cd23dbf747d2de2c10f5e5fad035df5a55d0a0e57c7b303f
-
Filesize
48KB
MD582b0b3e846bfb6444b9afebf9e5f1384
SHA1157e972fc30185df09db1780dbee3733d71a37b8
SHA25627b53affa6a064d1b94b9bcb8b1dbb50b8d776799da6704a44eddd5cfb161c8a
SHA512af315baa285c672a00583174f19ea888764476ce59ca89ade5dd24382c9912b89167cd01dd53dbe5cd23dbf747d2de2c10f5e5fad035df5a55d0a0e57c7b303f
-
Filesize
48KB
MD582b0b3e846bfb6444b9afebf9e5f1384
SHA1157e972fc30185df09db1780dbee3733d71a37b8
SHA25627b53affa6a064d1b94b9bcb8b1dbb50b8d776799da6704a44eddd5cfb161c8a
SHA512af315baa285c672a00583174f19ea888764476ce59ca89ade5dd24382c9912b89167cd01dd53dbe5cd23dbf747d2de2c10f5e5fad035df5a55d0a0e57c7b303f