Analysis
-
max time kernel
151s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 20:58
General
-
Target
50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce.exe
-
Size
68KB
-
MD5
13ba834cea20e5b408e7ad03919aa8b3
-
SHA1
f8466b5f4b8474a2c38d66f138e8c240b48fcedd
-
SHA256
50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce
-
SHA512
3b6b96202dd404df78f49c26f1c246e226f40eed90f25d1dc84032d70d5165ce91549d858a74e69708ae5579ba41e0695c9a4d3d5b30c150ea1668130bcdd55b
-
SSDEEP
768:BctliTdOpOpAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:OtIx1AcqOK3qowgnt1d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce.exe"C:\Users\Admin\AppData\Local\Temp\50f8a6ac458c15aa92cce614b43ec949ab72dfc6482ff2e419cd5b05ef9085ce.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5af746cce3b8d4dcd263a33eb4ae178bb
SHA1f07484b084c4ce997ef7ed5128a392f149de998c
SHA256ad08f4ac1456d573eaa5dfff2a134553d5cbd6d4749152425a5d80f6ad3c0985
SHA512a4dc600d759eeb1cb5a590aab96a88e53c784901e8667c5ef234c9fee5f91b4e8a30863af43d33f311886ae5f3a6ca9e533b8d9ba844a92201768db3729d3717
-
Filesize
68KB
MD5af746cce3b8d4dcd263a33eb4ae178bb
SHA1f07484b084c4ce997ef7ed5128a392f149de998c
SHA256ad08f4ac1456d573eaa5dfff2a134553d5cbd6d4749152425a5d80f6ad3c0985
SHA512a4dc600d759eeb1cb5a590aab96a88e53c784901e8667c5ef234c9fee5f91b4e8a30863af43d33f311886ae5f3a6ca9e533b8d9ba844a92201768db3729d3717
-
Filesize
68KB
MD5af746cce3b8d4dcd263a33eb4ae178bb
SHA1f07484b084c4ce997ef7ed5128a392f149de998c
SHA256ad08f4ac1456d573eaa5dfff2a134553d5cbd6d4749152425a5d80f6ad3c0985
SHA512a4dc600d759eeb1cb5a590aab96a88e53c784901e8667c5ef234c9fee5f91b4e8a30863af43d33f311886ae5f3a6ca9e533b8d9ba844a92201768db3729d3717
-
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
8KB