Analysis
-
max time kernel
117s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
23-11-2022 16:45
General
-
Target
9cf13281b541e2defe56505b69f8df2945c85876a438649e44bc7a98929d68aa.exe
-
Size
88KB
-
MD5
5e690fa19585e0e553366311ee0a16c0
-
SHA1
08b53f2a499dc15cba5d6c4d055d3c780ef52324
-
SHA256
9cf13281b541e2defe56505b69f8df2945c85876a438649e44bc7a98929d68aa
-
SHA512
ba6168f3a4c85770952e023b3fff1e7b3dc1d103a5ef43b74f6fb77b59f8aa3c0c36fa9a02ad36a1eb9be80dfcabec9ccc344d69ad9e6f6ac17bb63367fd1fcb
-
SSDEEP
1536:6eUDdZnW1pLDcw3Hr+PaGme7pPXLq0zTrkyP:JUDrnl1XTzToyP
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 29 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cf13281b541e2defe56505b69f8df2945c85876a438649e44bc7a98929d68aa.exe"C:\Users\Admin\AppData\Local\Temp\9cf13281b541e2defe56505b69f8df2945c85876a438649e44bc7a98929d68aa.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\meiiwuf.exe"C:\Users\Admin\meiiwuf.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5ed541bd468418b5d297bbeb42b73db5b
SHA188c9c8f8f7dd58c97481461fda97dc452173fe1f
SHA2569e20f481be3932960b46be2f0813f570e5c01a6e8f43396e33aff10cb22d2be7
SHA512bfb915d792ee1b93d6437761042856c1af4e188b4b98141066d0d0e51c5c84cab6a2fe8deb150a047b47329132979a5e650b9d67941c2fdbc9fb4030ec2a26aa
-
Filesize
88KB
MD5ed541bd468418b5d297bbeb42b73db5b
SHA188c9c8f8f7dd58c97481461fda97dc452173fe1f
SHA2569e20f481be3932960b46be2f0813f570e5c01a6e8f43396e33aff10cb22d2be7
SHA512bfb915d792ee1b93d6437761042856c1af4e188b4b98141066d0d0e51c5c84cab6a2fe8deb150a047b47329132979a5e650b9d67941c2fdbc9fb4030ec2a26aa
-
Filesize
88KB
MD5ed541bd468418b5d297bbeb42b73db5b
SHA188c9c8f8f7dd58c97481461fda97dc452173fe1f
SHA2569e20f481be3932960b46be2f0813f570e5c01a6e8f43396e33aff10cb22d2be7
SHA512bfb915d792ee1b93d6437761042856c1af4e188b4b98141066d0d0e51c5c84cab6a2fe8deb150a047b47329132979a5e650b9d67941c2fdbc9fb4030ec2a26aa
-
Filesize
88KB
MD5ed541bd468418b5d297bbeb42b73db5b
SHA188c9c8f8f7dd58c97481461fda97dc452173fe1f
SHA2569e20f481be3932960b46be2f0813f570e5c01a6e8f43396e33aff10cb22d2be7
SHA512bfb915d792ee1b93d6437761042856c1af4e188b4b98141066d0d0e51c5c84cab6a2fe8deb150a047b47329132979a5e650b9d67941c2fdbc9fb4030ec2a26aa
-
-
Filesize
8KB