Overview

overview

6

Static

static

Rastreamen...al.exe

windows7-x64

6

Rastreamen...al.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 19:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RastreamentoCorreiosSF103952BRPostal.exe

  • Size

    6.8MB

  • MD5

    7ac7f1986b6ce19a97b7c4647edc0c83

  • SHA1

    9dca3bf02cadd64f379b52471dff66697fa0b1fc

  • SHA256

    e2a3e3dc406bc8f553b4ce463697a645311491cae7c379678a57d8187539b09b

  • SHA512

    54cd7377b692eac84c99811bcfe3f168ec99016d8cc648a9ca5109db6852fe15de15efda96297f39d7a7b3e18540ac3cf7f05c2e3353f159c3b028afba601022

  • SSDEEP

    49152:oR90XgnL+6JWysaYmIGKwbWKknTPsTlSt03:oR90XeL9WAYm0IWKKQL

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Users\Admin\AppData\Local\Temp\RastreamentoCorreiosSF103952BRPostal.exe
    "C:\Users\Admin\AppData\Local\Temp\RastreamentoCorreiosSF103952BRPostal.exe"
    1⤵
    • Adds Run key to start application
    PID:2008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2008-54-0x0000000075A91000-0x0000000075A93000-memory.dmp
    Filesize

    8KB

    Download