Analysis

  • max time kernel
    151s
  • max time network
    76s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 16:30

General

  • Target

    087c034840ef8a3807faf1786aa42a14d393bcdb13ed0241c84bb2d2c0ca067a.exe

  • Size

    96KB

  • MD5

    8410480295a216636114c9b277c48dde

  • SHA1

    d8937c7c8a2955d4f03fcabca0a574a0bbba4556

  • SHA256

    087c034840ef8a3807faf1786aa42a14d393bcdb13ed0241c84bb2d2c0ca067a

  • SHA512

    65554953f29506f0500f93f276320843aecc4a534a5d87204c17aca3cf90ad10d167cbf2843f3a703f6d6168ab7cd5b1fa852ba91c78376a2708150c4af76215

  • SSDEEP

    1536:LxQBHff6cO/h36kGulSc16l6u+NMMl/KlYv1Tq5ThFNNIjni:ssh3Plu8CFFNCni

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 55 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\087c034840ef8a3807faf1786aa42a14d393bcdb13ed0241c84bb2d2c0ca067a.exe
    "C:\Users\Admin\AppData\Local\Temp\087c034840ef8a3807faf1786aa42a14d393bcdb13ed0241c84bb2d2c0ca067a.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1444
    • C:\Users\Admin\yiais.exe
      "C:\Users\Admin\yiais.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:844

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\yiais.exe

          Filesize

          96KB

          MD5

          9c39533e56ac07d8b09c1fca55884f62

          SHA1

          768db764c8c19cce9991373120afc41221016040

          SHA256

          efd8221368019d9c7a6ad4909534badee4ee2842d7bd30f010e696401880ba9d

          SHA512

          9230e5d69226852e77815f946fe9d929d5f815d97141840602fd58a0afea683f90d8f4569a963311ee3001d2244fabbfb1b519679a8db7bfb08f4f400f1af2b8

        • C:\Users\Admin\yiais.exe

          Filesize

          96KB

          MD5

          9c39533e56ac07d8b09c1fca55884f62

          SHA1

          768db764c8c19cce9991373120afc41221016040

          SHA256

          efd8221368019d9c7a6ad4909534badee4ee2842d7bd30f010e696401880ba9d

          SHA512

          9230e5d69226852e77815f946fe9d929d5f815d97141840602fd58a0afea683f90d8f4569a963311ee3001d2244fabbfb1b519679a8db7bfb08f4f400f1af2b8

        • \Users\Admin\yiais.exe

          Filesize

          96KB

          MD5

          9c39533e56ac07d8b09c1fca55884f62

          SHA1

          768db764c8c19cce9991373120afc41221016040

          SHA256

          efd8221368019d9c7a6ad4909534badee4ee2842d7bd30f010e696401880ba9d

          SHA512

          9230e5d69226852e77815f946fe9d929d5f815d97141840602fd58a0afea683f90d8f4569a963311ee3001d2244fabbfb1b519679a8db7bfb08f4f400f1af2b8

        • \Users\Admin\yiais.exe

          Filesize

          96KB

          MD5

          9c39533e56ac07d8b09c1fca55884f62

          SHA1

          768db764c8c19cce9991373120afc41221016040

          SHA256

          efd8221368019d9c7a6ad4909534badee4ee2842d7bd30f010e696401880ba9d

          SHA512

          9230e5d69226852e77815f946fe9d929d5f815d97141840602fd58a0afea683f90d8f4569a963311ee3001d2244fabbfb1b519679a8db7bfb08f4f400f1af2b8

        • memory/1444-56-0x0000000075D71000-0x0000000075D73000-memory.dmp

          Filesize

          8KB