Analysis
-
max time kernel
45s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
25/11/2022, 12:31
General
-
Target
aa1020de6275c56d118a7811ed6b32289dd83a5dda40b73f95868d1e88dcd0ef.exe
-
Size
1.8MB
-
MD5
1b6b866e02a945b4526de5f5a77772e3
-
SHA1
c29b1e502a13976ec60a23cdcd9c337fdd10941a
-
SHA256
aa1020de6275c56d118a7811ed6b32289dd83a5dda40b73f95868d1e88dcd0ef
-
SHA512
e9b987ba4e425a75740387c57a579dfa21b57feb7e05b66b748eed80093210cab0ee5aeacb06bdbe8d63293cf31c066377430968c13ef79911da13efb91fee9d
-
SSDEEP
24576:DueR0gTo4GNmYsM1bgkv+0d5wV0vOVyNzKRBehm9dN3YvandAk+hr7/SQvsp:DTw4HDkW0dXOVsYs8dFYvanGVhr7qp
Malware Config
Signatures
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa1020de6275c56d118a7811ed6b32289dd83a5dda40b73f95868d1e88dcd0ef.exe"C:\Users\Admin\AppData\Local\Temp\aa1020de6275c56d118a7811ed6b32289dd83a5dda40b73f95868d1e88dcd0ef.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB