Analysis
-
max time kernel
155s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
24-11-2022 05:49
General
-
Target
486d1e8a7d0bd85c206ca8ce71fbe5314eca5cf5d8dcac41ce88e68ba8729200.exe
-
Size
68KB
-
MD5
e6b99d2f00e4c19a852d9d57a6f9db1d
-
SHA1
fd6b0c8aaf752df46f5962defc69b7b1b0b56b22
-
SHA256
486d1e8a7d0bd85c206ca8ce71fbe5314eca5cf5d8dcac41ce88e68ba8729200
-
SHA512
1489117cbc6eb89cbddd2872a2d68b05a7ebec5b8c9a520e4331ca29a0a8a6d55acb994f1c368069e259c025e00e1419da4155120ff51d7136e9813465625f41
-
SSDEEP
768:Wc2liTdScAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:t2IxbAcqOK3qowgnt1d
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\486d1e8a7d0bd85c206ca8ce71fbe5314eca5cf5d8dcac41ce88e68ba8729200.exe"C:\Users\Admin\AppData\Local\Temp\486d1e8a7d0bd85c206ca8ce71fbe5314eca5cf5d8dcac41ce88e68ba8729200.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5bde4c7dcbe1522667bb63f51a9e8cf48
SHA11aa4ca6f461fa9570f1cdc61a5c1ab67fd389280
SHA25605c5a1d8c732a84db2c2a912d3e4bc1030bdeff2d196f216002ca1ae8993c5aa
SHA51251fc27b79a4f438e60617cc7a3f37a3398ad449b009522f94da00c39989df02ee3a36e175642160cbccb2f55eaad5cad470e1c67e234dc9ec3cca37266efdacd
-
Filesize
68KB
MD5bde4c7dcbe1522667bb63f51a9e8cf48
SHA11aa4ca6f461fa9570f1cdc61a5c1ab67fd389280
SHA25605c5a1d8c732a84db2c2a912d3e4bc1030bdeff2d196f216002ca1ae8993c5aa
SHA51251fc27b79a4f438e60617cc7a3f37a3398ad449b009522f94da00c39989df02ee3a36e175642160cbccb2f55eaad5cad470e1c67e234dc9ec3cca37266efdacd
-
Filesize
68KB
MD5bde4c7dcbe1522667bb63f51a9e8cf48
SHA11aa4ca6f461fa9570f1cdc61a5c1ab67fd389280
SHA25605c5a1d8c732a84db2c2a912d3e4bc1030bdeff2d196f216002ca1ae8993c5aa
SHA51251fc27b79a4f438e60617cc7a3f37a3398ad449b009522f94da00c39989df02ee3a36e175642160cbccb2f55eaad5cad470e1c67e234dc9ec3cca37266efdacd
-
Filesize
84KB
-
Filesize
8KB
-
-
Filesize
84KB