2c7f86463ea0fbf195720c48288ec7fe03abec474b210865255bcf50e6108d94

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

416/1192e513c036fa5b640ccf1796790b03341fa50e6b20254e75f534d35e846a71.exe
Size

158KB
MD5

5a9d9ebc2f4122053702b6ba7f205a4f
SHA1

b30c4f46a1bc8db7f50ba937cc9e495ee14946df
SHA256

1192e513c036fa5b640ccf1796790b03341fa50e6b20254e75f534d35e846a71
SHA512

f3d0c12db709bd0c11ec369736fecf4f3db8d898e58189a3d47c8d42d6f43d1d9dab2694fec28a63a42c2dd1395b55a2eb0de011ecc64e6e0082f4ee02d59d1a
SSDEEP

3072:z2HGK/3NhIXAH9G4s1OYTesnOB6O8cElJib+Ku2rqpZHXME0fqY:z2HGK/3IXg927TeWOB6O8cEm22sZHXrv

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

1192e513c036fa5b640ccf1796790b03341fa50e6b20254e75f534d35e846a71.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\416\\Untitled.png"	1192e513c036fa5b640ccf1796790b03341fa50e6b20254e75f534d35e846a71.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	1192e513c036fa5b640ccf1796790b03341fa50e6b20254e75f534d35e846a71.exe

C:\Users\Admin\AppData\Local\Temp\416\1192e513c036fa5b640ccf1796790b03341fa50e6b20254e75f534d35e846a71.exe
"C:\Users\Admin\AppData\Local\Temp\416\1192e513c036fa5b640ccf1796790b03341fa50e6b20254e75f534d35e846a71.exe"
1⤵
- Sets desktop wallpaper using registry
PID:1996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000000BE0000-0x0000000000C0E000-memory.dmp

Filesize
184KB

Download