Analysis

  • max time kernel
    171s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 18:38

General

  • Target

    f8e2fb1d7398fed7e143a30d5214ae87c835f41878deab413710a7c877cf9fc4.exe

  • Size

    236KB

  • MD5

    571b029db85a310dac5d7f7812612e52

  • SHA1

    2b35f677215061778e23be1004d280e6e10942c8

  • SHA256

    f8e2fb1d7398fed7e143a30d5214ae87c835f41878deab413710a7c877cf9fc4

  • SHA512

    ad501cc8920e87304d1edd0245e1a09ab0fc73dc8d6e6bd3c41f2c7027643fef5b1b3d88da428f45dde11010364982d9b7f92718df19f8dd745baa0ee1ddfe26

  • SSDEEP

    3072:NdNhROjlwKzzGKXWr8oYLVp0uP5cPLa6KMWM+x2rfdnpcJMyaegtmNZW6g4Y:Nt1mzGkoYZpDPCPLa64fmdK+dtCe

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8e2fb1d7398fed7e143a30d5214ae87c835f41878deab413710a7c877cf9fc4.exe
    "C:\Users\Admin\AppData\Local\Temp\f8e2fb1d7398fed7e143a30d5214ae87c835f41878deab413710a7c877cf9fc4.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\loyov.exe
      "C:\Users\Admin\loyov.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\loyov.exe

    Filesize

    236KB

    MD5

    fd39f71ccfa7b5c984f67f3797573c79

    SHA1

    fcb39a7e6c09eea81a8796beb21382aaaf377e00

    SHA256

    28de8c640411f59e99028142d0825127ed1d1303443654bc4f49ee3f53eaac4e

    SHA512

    16864e1ea1f27b5f566c232c6d3910a3bd5bee68e278e8601a0125cfe00a9237cac06fde0c972f505ea363e052b09af15e63fc3781a2f512452e985a5f28d211

  • C:\Users\Admin\loyov.exe

    Filesize

    236KB

    MD5

    fd39f71ccfa7b5c984f67f3797573c79

    SHA1

    fcb39a7e6c09eea81a8796beb21382aaaf377e00

    SHA256

    28de8c640411f59e99028142d0825127ed1d1303443654bc4f49ee3f53eaac4e

    SHA512

    16864e1ea1f27b5f566c232c6d3910a3bd5bee68e278e8601a0125cfe00a9237cac06fde0c972f505ea363e052b09af15e63fc3781a2f512452e985a5f28d211

  • \Users\Admin\loyov.exe

    Filesize

    236KB

    MD5

    fd39f71ccfa7b5c984f67f3797573c79

    SHA1

    fcb39a7e6c09eea81a8796beb21382aaaf377e00

    SHA256

    28de8c640411f59e99028142d0825127ed1d1303443654bc4f49ee3f53eaac4e

    SHA512

    16864e1ea1f27b5f566c232c6d3910a3bd5bee68e278e8601a0125cfe00a9237cac06fde0c972f505ea363e052b09af15e63fc3781a2f512452e985a5f28d211

  • \Users\Admin\loyov.exe

    Filesize

    236KB

    MD5

    fd39f71ccfa7b5c984f67f3797573c79

    SHA1

    fcb39a7e6c09eea81a8796beb21382aaaf377e00

    SHA256

    28de8c640411f59e99028142d0825127ed1d1303443654bc4f49ee3f53eaac4e

    SHA512

    16864e1ea1f27b5f566c232c6d3910a3bd5bee68e278e8601a0125cfe00a9237cac06fde0c972f505ea363e052b09af15e63fc3781a2f512452e985a5f28d211

  • memory/1076-56-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/1076-57-0x0000000075141000-0x0000000075143000-memory.dmp

    Filesize

    8KB

  • memory/1076-65-0x0000000003080000-0x00000000030D7000-memory.dmp

    Filesize

    348KB

  • memory/1076-66-0x0000000003080000-0x00000000030D7000-memory.dmp

    Filesize

    348KB

  • memory/1076-69-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/1520-60-0x0000000000000000-mapping.dmp

  • memory/1520-67-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB

  • memory/1520-70-0x0000000000400000-0x0000000000457000-memory.dmp

    Filesize

    348KB