Overview

overview

6

Static

static

5c14a36e1a...b4.exe

windows7-x64

6

5c14a36e1a...b4.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    145s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 17:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe

  • Size

    1.1MB

  • MD5

    d566f0dff614345edb4f1c2b42320166

  • SHA1

    238ffa12a87f991bd259f87f30742ef518f0eb86

  • SHA256

    5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4

  • SHA512

    5bacdc05fd6169840a0e8e3e4e7adc81146183f8bc0051460416863e816df918997486c185b41d0ca251eb6bacf7020dc5f9b9ecfe3ea95c19fb3fc3384e5cc2

  • SSDEEP

    24576:nR3s+cam94RPmQh0tC3WMw2SRvjdtprWlgSZj70h:nRc4b0Q8pDrpQv

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe
    "C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe
      "C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe"
      2⤵
        PID:556
      • C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe
        "C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe"
        2⤵
          PID:468
        • C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe
          "C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe"
          2⤵
            PID:520
          • C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe
            "C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe"
            2⤵
              PID:1160
            • C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe
              "C:\Users\Admin\AppData\Local\Temp\5c14a36e1a1becb37de152d55d8186e18e068d0ea45908aedef3722c1b0e49b4.exe"
              2⤵
                PID:1012
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
              1⤵
              • Suspicious use of FindShellTrayWindow
              PID:1340

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\10685264_719833148066167_368753692_n.jpg
              Filesize

              75KB

              MD5

              a35b68b67940fc6bd5b5e3286bf3d0f3

              SHA1

              9eee1fdf2df4301f7675d65fe5649596ba49931a

              SHA256

              a7088bba39efbd8e02960756c13c9505cd27cc783f3986245e350f860b98f7b9

              SHA512

              b443edde9996eb14fbc285a8dea002ea99683b7ec8fa5a40b6a1e819198b12fb80c042e2d866dc6c9f3900ac1e66a66a7502d869a27382c5331239e5b12c741f

              Download Submit

            • memory/1712-54-0x0000000075071000-0x0000000075073000-memory.dmp

              Filesize

              8KB

              Download

            • memory/1712-55-0x0000000073F70000-0x000000007451B000-memory.dmp

              Filesize

              5.7MB

              Download

            • memory/1712-58-0x0000000000145000-0x0000000000156000-memory.dmp

              Filesize

              68KB

              Download

            • memory/1712-59-0x0000000073F70000-0x000000007451B000-memory.dmp

              Filesize

              5.7MB

              Download