Analysis
-
max time kernel
151s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:42
Static task
static1
Behavioral task
behavioral1
Sample
8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe
Resource
win10v2004-20221111-en
General
-
Target
8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe
-
Size
123KB
-
MD5
ccf3daf42a7b1e0d1c6769b8d6d2abb9
-
SHA1
12e637c327644cc59c969c74fde5ed3060dcd6d3
-
SHA256
8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024
-
SHA512
820a445538123cf8201c2ac491a925d362f6cd9bcc91225524412363d1b7fc1b113ee8be020f4bdbe7086a31076b03e2a2a3d27a48c535c6882b07682b37df28
-
SSDEEP
3072:YU6G6LQjmAdnyuFIZyE1XRrTehAqXANWqh1EdtG7D:YU658n7aZyE1Xt0X8Wqhe2
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AAS = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe /cs:1 " 8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\AAS = "\"C:\\ProgramData\\514b03\\AA514_8007.exe\" /s" 8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe -
Checks for any installed AV software in registry 1 TTPs 1 IoCs
Processes:
8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\ 8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe"C:\Users\Admin\AppData\Local\Temp\8d1dcf57fb460b0cf84b594c9d1f69dae46d80d0c86dd6f1cfabe648c4314024.exe"1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2040-54-0x0000000000230000-0x0000000000237000-memory.dmpFilesize
28KB
-
memory/2040-55-0x0000000000230000-0x0000000000237000-memory.dmpFilesize
28KB
-
memory/2040-56-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/2040-57-0x00000000762F1000-0x00000000762F3000-memory.dmpFilesize
8KB
-
memory/2040-58-0x0000000000400000-0x0000000000441000-memory.dmpFilesize
260KB