Analysis

  • max time kernel
    224s
  • max time network
    197s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 00:16

General

  • Target

    87a021a7cc44852cab8228cbcf835971c21728c309e613f38737b5e4c9f1ae4d.exe

  • Size

    188KB

  • MD5

    34fef6065be5ae014a135816e5c029e0

  • SHA1

    260b1faab253b6f310fa65371e08225873c11280

  • SHA256

    87a021a7cc44852cab8228cbcf835971c21728c309e613f38737b5e4c9f1ae4d

  • SHA512

    e950dc828575edba101062f79f066e0e93e3283babfa7761e11b9559a907112495a1369c93a6900af00e66a2807131ac43ed3d866186a130a42956e4e8dcec60

  • SSDEEP

    3072:5CbOetokrGwkAjpWn1KG912QXXU+EnHsRPaVh4oQZiEVwiJ:52GdwkGG9ggkMRPaJWJ

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 48 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87a021a7cc44852cab8228cbcf835971c21728c309e613f38737b5e4c9f1ae4d.exe
    "C:\Users\Admin\AppData\Local\Temp\87a021a7cc44852cab8228cbcf835971c21728c309e613f38737b5e4c9f1ae4d.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Users\Admin\weooxeq.exe
      "C:\Users\Admin\weooxeq.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1488

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\weooxeq.exe

    Filesize

    188KB

    MD5

    8284abd12598b3a25160c7714b236acf

    SHA1

    2e2aa779c04c229e86f919fbf567715c45dd658a

    SHA256

    bb8cfc170a693c69d6855efe284adf501e6571afd14eca5a3d543046d3a3454e

    SHA512

    2f1924dd37b59050e224aa6f4479b3ad1a96b867ac8ce5fb67622ae0717f948154985f3ed97f692bdeb2f79eae479e61611e91b68680ff8d760be069645ecd8d

  • C:\Users\Admin\weooxeq.exe

    Filesize

    188KB

    MD5

    8284abd12598b3a25160c7714b236acf

    SHA1

    2e2aa779c04c229e86f919fbf567715c45dd658a

    SHA256

    bb8cfc170a693c69d6855efe284adf501e6571afd14eca5a3d543046d3a3454e

    SHA512

    2f1924dd37b59050e224aa6f4479b3ad1a96b867ac8ce5fb67622ae0717f948154985f3ed97f692bdeb2f79eae479e61611e91b68680ff8d760be069645ecd8d

  • \Users\Admin\weooxeq.exe

    Filesize

    188KB

    MD5

    8284abd12598b3a25160c7714b236acf

    SHA1

    2e2aa779c04c229e86f919fbf567715c45dd658a

    SHA256

    bb8cfc170a693c69d6855efe284adf501e6571afd14eca5a3d543046d3a3454e

    SHA512

    2f1924dd37b59050e224aa6f4479b3ad1a96b867ac8ce5fb67622ae0717f948154985f3ed97f692bdeb2f79eae479e61611e91b68680ff8d760be069645ecd8d

  • \Users\Admin\weooxeq.exe

    Filesize

    188KB

    MD5

    8284abd12598b3a25160c7714b236acf

    SHA1

    2e2aa779c04c229e86f919fbf567715c45dd658a

    SHA256

    bb8cfc170a693c69d6855efe284adf501e6571afd14eca5a3d543046d3a3454e

    SHA512

    2f1924dd37b59050e224aa6f4479b3ad1a96b867ac8ce5fb67622ae0717f948154985f3ed97f692bdeb2f79eae479e61611e91b68680ff8d760be069645ecd8d

  • memory/1288-70-0x0000000002D30000-0x0000000002D67000-memory.dmp

    Filesize

    220KB

  • memory/1288-57-0x0000000075551000-0x0000000075553000-memory.dmp

    Filesize

    8KB

  • memory/1288-54-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/1288-65-0x0000000002D30000-0x0000000002D67000-memory.dmp

    Filesize

    220KB

  • memory/1288-66-0x0000000002D30000-0x0000000002D67000-memory.dmp

    Filesize

    220KB

  • memory/1288-71-0x0000000002D30000-0x0000000002D67000-memory.dmp

    Filesize

    220KB

  • memory/1288-69-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/1488-60-0x0000000000000000-mapping.dmp

  • memory/1488-67-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/1488-72-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB