Analysis
-
max time kernel
167s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07/11/2022, 09:55
General
-
Target
e1eb2017651d6daf220c2576268d32fc9e7a0d11ef7a4c52f15750b7b8f72cfa.exe
-
Size
76KB
-
MD5
06da6fd21bcff5c3dbefed8563fb8b7c
-
SHA1
8525f1aa97a3fde352e35df3ab1cbf5dca341ddf
-
SHA256
e1eb2017651d6daf220c2576268d32fc9e7a0d11ef7a4c52f15750b7b8f72cfa
-
SHA512
9a30e17b9793bcc942fc47f7db9dabdcbb8d611bbb4aca39533f3925427126d52d0db234918744120e06453c9612a07322712548dbbdaea82f61769a0c861789
-
SSDEEP
1536:p3xVPoyObzZ59oxYNwFwlIvgOXEObEtzp2q1R5Rz7:p3noZPZ59b0wlI4O0N1fJ7
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1eb2017651d6daf220c2576268d32fc9e7a0d11ef7a4c52f15750b7b8f72cfa.exe"C:\Users\Admin\AppData\Local\Temp\e1eb2017651d6daf220c2576268d32fc9e7a0d11ef7a4c52f15750b7b8f72cfa.exe"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\ads.exeC:\Windows\ads.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\ads.exeC:\Windows\ads.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420B
MD5b2b046dac5ad7c0939e90564cac43e9c
SHA18c33f7b86d0c4352d9d0dc0a4b55debf26346d4a
SHA256e34fe81eabef2bb61177783c03c8042752b33b93e0ef6672a3b9e5698db1c865
SHA512199c65f9e10022fd4d1294f765afee66deb8b5d7d44b5357b5532ea89db4ef97627d1025468c2fa63f0878da1aa8811386e19a528bfc42bce7b936a07bf1dd02
-
Filesize
9KB
MD525e3e75dd5d6f30361d61e919335858e
SHA18ec690d03b8e684911d8ba56014d4787e9259dd1
SHA256556a6fbbcc8e98218bb37809bdc03bf149fa25de12afc0d848f45160d0e1d9a9
SHA512065e1033ebba7d92c901505695b9a5d60fc54f1aa530b068234392b2f29df9a641baa1b9ea5ea817cdd017aecbdeba083f46414fece8d4ad7f56561104c8edf7
-
Filesize
4KB
MD5c64481cc98427fcd594be2aead5ae6f6
SHA1a3870ae306bf9c97d671f427e81c3bcbb86ca2f0
SHA2565cb1dd17d8f085b5e3b4654893c6aad4dde9dbe3de2574da72c24a6cf3a4ec6e
SHA512dcd815acb359643be1bc536d0d0d064a69f6f978b118e161d9503aeee62a64d1bd1bd723fda12cfe47b006c2a5206237199f8dcd20259a790fa27eb6aacddbce
-
Filesize
32KB
MD53f70c0b1c1a3645eb31e7f04ef62e56b
SHA1a71bcfc497e92f28d884ab5e40893f0bd5e92690
SHA2569f6547297df9303c69a735238b3f4b92fce827cd014266295618fee07362c315
SHA5128968987bf5ac59e0ced36916468eb99d6867b8cb876c01e0a5b58e1f8d226434617d86577d637d8374e53be9263edd334a3d02e0ab15ddc6ef21da41e3376997
-
Filesize
32KB
MD53f70c0b1c1a3645eb31e7f04ef62e56b
SHA1a71bcfc497e92f28d884ab5e40893f0bd5e92690
SHA2569f6547297df9303c69a735238b3f4b92fce827cd014266295618fee07362c315
SHA5128968987bf5ac59e0ced36916468eb99d6867b8cb876c01e0a5b58e1f8d226434617d86577d637d8374e53be9263edd334a3d02e0ab15ddc6ef21da41e3376997
-
Filesize
32KB
MD53f70c0b1c1a3645eb31e7f04ef62e56b
SHA1a71bcfc497e92f28d884ab5e40893f0bd5e92690
SHA2569f6547297df9303c69a735238b3f4b92fce827cd014266295618fee07362c315
SHA5128968987bf5ac59e0ced36916468eb99d6867b8cb876c01e0a5b58e1f8d226434617d86577d637d8374e53be9263edd334a3d02e0ab15ddc6ef21da41e3376997
-
Filesize
180KB
-
Filesize
180KB
-
Filesize
180KB
