Analysis
-
max time kernel
45s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
25-11-2022 15:11
General
-
Target
2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5.exe
-
Size
540KB
-
MD5
466606b22ec6b4d8ddc0916cdd1b7fcb
-
SHA1
9e5180f41d226abb2f9f4f05abd39b89ea1531b9
-
SHA256
2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5
-
SHA512
2ad23c61d8f035f00dbf205530cdd9de1b183045d6717e9bc7f8e1441ba0f40ffd67edd9f50bcaac06e55b557c0fbae77c04db8039fc7ee854a72513dbf02291
-
SSDEEP
12288:+f8w94y9NpM38r6ArJ8OIqYJY2xzuLnqWk21/g5x:fwRTcW6ArJ8zqYenqWkR5x
Malware Config
Signatures
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Loads dropped DLL 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5.exe"C:\Users\Admin\AppData\Local\Temp\2ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
540KB
MD5466606b22ec6b4d8ddc0916cdd1b7fcb
SHA19e5180f41d226abb2f9f4f05abd39b89ea1531b9
SHA2562ddcb51962bfd990f021e3a03347b363778daf20951a14667ec658ef013bbaa5
SHA5122ad23c61d8f035f00dbf205530cdd9de1b183045d6717e9bc7f8e1441ba0f40ffd67edd9f50bcaac06e55b557c0fbae77c04db8039fc7ee854a72513dbf02291
-
Filesize
8KB