Analysis
- max time kernel
90s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
07/11/2022, 22:13
General
- Target 13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8.exe
- Size 3.5MB
- Sample221107-1433kaebgr
- SHA256 13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8
Malware Config
Signatures
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8.exe"C:\Users\Admin\AppData\Local\Temp\13be15f6a616492f6b0337a92904fea93faa54c3b2a25a8584a22cbeb16005a8.exe"1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1808-132-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-133-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-134-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-136-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-138-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-140-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-142-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-144-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-146-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-148-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-150-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-152-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-154-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-156-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-158-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-160-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-162-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-164-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-166-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-168-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-170-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-172-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-174-0x0000000010000000-0x000000001003E000-memory.dmp
memory/1808-175-0x0000000010000000-0x000000001003E000-memory.dmp