Overview

overview

8

Static

static

8

10-22Ѽ...��.exe

windows7-x64

8

10-22Ѽ...��.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    186s
  • max time network
    218s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 20:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    10-22Ѽڴ0.7b.exe

  • Size

    824KB

  • MD5

    0d997ecaab8c28b63daec05adf9b78d1

  • SHA1

    1dddfe8d3413e907aca6a8e4915e9e080795d16d

  • SHA256

    358f54de48ed0beeee28138ec106ff87f77510750a985755927905a6f5125985

  • SHA512

    31319989f559e9da204bc8e34a6c02438bfd2af8d6f6052bdaa8c7f347299b777049aa928387b25be6da4b9868edcef87c0f9360a9d13831756e46d6e0ba4d9c

  • SSDEEP

    12288:FYyRet8RUgQvB3vxofBrbC4U6FV88d93FHoKlf/oDwm2eTPf9dxet2hk7N+X4hmw:FY/eP+B3vY9FPPoKF/oDwm1rPArUXHE

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\10-22Ѽڴ0.7b.exe
    "C:\Users\Admin\AppData\Local\Temp\10-22Ѽڴ0.7b.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3272

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3272-132-0x0000000000400000-0x00000000005F2000-memory.dmp

    Filesize

    1.9MB

    Download