Overview
overview
10Static
static
5Accessible.tlb
windows7-x64
3Accessible.tlb
windows10-2004-x64
3Cracker.dll
windows7-x64
1Cracker.dll
windows10-2004-x64
1Data/Language.pimx
windows7-x64
3Data/Language.pimx
windows10-2004-x64
3Data/Main.ini
windows7-x64
1Data/Main.ini
windows10-2004-x64
1Data/Packa...in.xml
windows7-x64
1Data/Packa...in.xml
windows10-2004-x64
1Data/Packa...ce.zip
windows7-x64
1Data/Packa...ce.zip
windows10-2004-x64
1Data/Packa...ls.xml
windows7-x64
1Data/Packa...ls.xml
windows10-2004-x64
Debug/DebugPPF.tmp
windows7-x64
3Debug/DebugPPF.tmp
windows10-2004-x64
3Debug/DebugPPT.tmp
windows7-x64
3Debug/DebugPPT.tmp
windows10-2004-x64
3Debug/Management.log
windows7-x64
1Debug/Management.log
windows10-2004-x64
1Microsoft ...ed.exe
windows7-x64
10Microsoft ...ed.exe
windows10-2004-x64
7Resource.dll
windows7-x64
Resource.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1update-settings.ini
windows7-x64
1update-settings.ini
windows10-2004-x64
1updater.ini
windows7-x64
1updater.ini
windows10-2004-x64
1Analysis
-
max time kernel
249s -
max time network
401s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 20:56
Static task
static1
Behavioral task
behavioral1
Sample
Accessible.tlb
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Accessible.tlb
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
Cracker.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Cracker.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Data/Language.pimx
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Data/Language.pimx
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Data/Main.ini
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Data/Main.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Data/Packaged/Main.xml
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Data/Packaged/Main.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Data/Packaged/Resource.zip
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Data/Packaged/Resource.zip
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Data/Packaged/Utils.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Data/Packaged/Utils.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
Debug/DebugPPF.tmp
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
Debug/DebugPPF.tmp
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Debug/DebugPPT.tmp
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Debug/DebugPPT.tmp
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Debug/Management.log
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
Debug/Management.log
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
Microsoft Office Pro Cracked.exe
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
Microsoft Office Pro Cracked.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
Resource.dll
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
Resource.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
libGLESv2.dll
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
libGLESv2.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
update-settings.ini
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
update-settings.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
updater.ini
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
updater.ini
Resource
win10v2004-20220812-en
General
-
Target
Accessible.tlb
-
Size
2KB
-
MD5
aa50295fb0d54e2fe77ce5de151e4f2d
-
SHA1
ece456a4fa4bf5fce40dd12bb2141468cf42e164
-
SHA256
224650096aa29b8a3c653a25384e56bbdc108326dc1849bbfdc70562f183e8b7
-
SHA512
6b2bcdd3279d9b1c30ab260d37ed78ee2ef99dd747b31f5ce7fd862e38c0501c4a3f16de399b558656a1702ff4379eaae2cdf49e14f46a96ce3dbda479122f1b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 2852 OpenWith.exe