Analysis
-
max time kernel
57s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 15:29
General
-
Target
ff5d41ef31f308f943f436ea842903b85c9532525b318441e85c2b913e487e1f.exe
-
Size
3.2MB
-
MD5
7cf7b081ae8d338791b985fa97fd6ce5
-
SHA1
8c692647a93ad7776cee8d49370f557f4cee8514
-
SHA256
ff5d41ef31f308f943f436ea842903b85c9532525b318441e85c2b913e487e1f
-
SHA512
f4a07121da959c1bc8c09f33ebc4d35b1de64c60efe8dc123d0221db1dad29d1c5fbf3d4af7b05b54e7bfb54f19b2834277a6ed3a7374a423a71cefe7b7e56b5
-
SSDEEP
98304:mHZWZAbrvGdksZI5a4OheQEq8YiwOBpIeWxvul:m5IkrvGdhZ4EHi1zwxa
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff5d41ef31f308f943f436ea842903b85c9532525b318441e85c2b913e487e1f.exe"C:\Users\Admin\AppData\Local\Temp\ff5d41ef31f308f943f436ea842903b85c9532525b318441e85c2b913e487e1f.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
893KB
MD504ad4b80880b32c94be8d0886482c774
SHA1344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
SHA256a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
SHA5123e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
-
Filesize
8KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
68KB
-
Filesize
68KB