Overview

overview

10

Static

static

a4a1f54828...50.exe

windows7-x64

10

a4a1f54828...50.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 07:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a4a1f5482887f231a0f75b9c3d2b841ed49eadc8aa09f4aac30d79c0f2dae850.exe

  • Size

    68KB

  • MD5

    ac16d9e8952333f60eb5cfd1a02bae4d

  • SHA1

    700044769b25e92ff47620bd8daeff56174e4f3d

  • SHA256

    a4a1f5482887f231a0f75b9c3d2b841ed49eadc8aa09f4aac30d79c0f2dae850

  • SHA512

    3c2d4dfa7e5594faf3eccbea2c1db0936830179a7d79badf08d1ff33690e57d483057b9bb0c5d3e0b69c427eaae831a13e7e7fbc82603a93f5a54eef4321ea81

  • SSDEEP

    768:4c8liTdKEAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:n8Ix3AcqOK3qowgnt1d

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4a1f5482887f231a0f75b9c3d2b841ed49eadc8aa09f4aac30d79c0f2dae850.exe
    "C:\Users\Admin\AppData\Local\Temp\a4a1f5482887f231a0f75b9c3d2b841ed49eadc8aa09f4aac30d79c0f2dae850.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1520

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Admin.exe
          Filesize

          68KB

          MD5

          df22374672237f115086d8d59303cf27

          SHA1

          aa960a1c984086ce960c80aa7990c9e0df7f1dae

          SHA256

          636fce42dc05e6f4b77d3ab61aa51847bec63276911277b55f5bdb70b44ab970

          SHA512

          9e68bedcf94886b2edef0a211da97dad8418aa318f39e6058a03e9248d2d9dd61727cd65c67e56c2615a803eb6b88cd97b3ed7e71d009178d6595d1c6a34a503

          Download Submit

        • \Users\Admin\Admin.exe
          Filesize

          68KB

          MD5

          df22374672237f115086d8d59303cf27

          SHA1

          aa960a1c984086ce960c80aa7990c9e0df7f1dae

          SHA256

          636fce42dc05e6f4b77d3ab61aa51847bec63276911277b55f5bdb70b44ab970

          SHA512

          9e68bedcf94886b2edef0a211da97dad8418aa318f39e6058a03e9248d2d9dd61727cd65c67e56c2615a803eb6b88cd97b3ed7e71d009178d6595d1c6a34a503

          Download Submit

        • \Users\Admin\Admin.exe
          Filesize

          68KB

          MD5

          df22374672237f115086d8d59303cf27

          SHA1

          aa960a1c984086ce960c80aa7990c9e0df7f1dae

          SHA256

          636fce42dc05e6f4b77d3ab61aa51847bec63276911277b55f5bdb70b44ab970

          SHA512

          9e68bedcf94886b2edef0a211da97dad8418aa318f39e6058a03e9248d2d9dd61727cd65c67e56c2615a803eb6b88cd97b3ed7e71d009178d6595d1c6a34a503

          Download Submit

        • memory/1520-62-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

          Download

        • memory/1672-54-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

          Download

        • memory/1672-57-0x0000000075111000-0x0000000075113000-memory.dmp

          Filesize

          8KB

          Download