Overview

overview

10

Static

static

9702d3a5d9...7a.exe

windows7-x64

10

9702d3a5d9...7a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9702d3a5d9dc54ef91fc413dc306dc265ff2addf252e8d1c2e7229efcc4d397a.exe

  • Size

    68KB

  • MD5

    e30dbf87542c57f8ba1fbf69b0a2d53d

  • SHA1

    c581a71cd77628db1714ecac31258048cb2db8ef

  • SHA256

    9702d3a5d9dc54ef91fc413dc306dc265ff2addf252e8d1c2e7229efcc4d397a

  • SHA512

    dff978daccdd3bcf44faee87fa15274eb2606c46ccfec7d8149d737699e624c84c9e7764f4e6e167f5e7b39536db24995100f1d721d21dbe51ba8555e57246c8

  • SSDEEP

    768:9cVliTdSAAl+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:6VIx7AcqOK3qowgnt1d

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9702d3a5d9dc54ef91fc413dc306dc265ff2addf252e8d1c2e7229efcc4d397a.exe
    "C:\Users\Admin\AppData\Local\Temp\9702d3a5d9dc54ef91fc413dc306dc265ff2addf252e8d1c2e7229efcc4d397a.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1044
    • C:\Users\Admin\Admin.exe
      "C:\Users\Admin\Admin.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Admin.exe
    Filesize

    68KB

    MD5

    34d40c2da98e5e5eafc6a62565a67ce5

    SHA1

    fc01b0b30e76937dff70c9107d627ecd4f55bc99

    SHA256

    8d815f49f617256c3279530a772270d5d63ff2e2c8a40669401703af341f1964

    SHA512

    9df292e527db9d9336972cd657073f5ddd703aa8b92ee23443e4743f323264128bfab7113f97a25bc98431d36899f3d95a7a0686a76b056b72ba26554c255161

    Download Submit
  • \Users\Admin\Admin.exe
    Filesize

    68KB

    MD5

    34d40c2da98e5e5eafc6a62565a67ce5

    SHA1

    fc01b0b30e76937dff70c9107d627ecd4f55bc99

    SHA256

    8d815f49f617256c3279530a772270d5d63ff2e2c8a40669401703af341f1964

    SHA512

    9df292e527db9d9336972cd657073f5ddd703aa8b92ee23443e4743f323264128bfab7113f97a25bc98431d36899f3d95a7a0686a76b056b72ba26554c255161

    Download Submit
  • \Users\Admin\Admin.exe
    Filesize

    68KB

    MD5

    34d40c2da98e5e5eafc6a62565a67ce5

    SHA1

    fc01b0b30e76937dff70c9107d627ecd4f55bc99

    SHA256

    8d815f49f617256c3279530a772270d5d63ff2e2c8a40669401703af341f1964

    SHA512

    9df292e527db9d9336972cd657073f5ddd703aa8b92ee23443e4743f323264128bfab7113f97a25bc98431d36899f3d95a7a0686a76b056b72ba26554c255161

    Download Submit
  • memory/1044-54-0x0000000000400000-0x0000000000415000-memory.dmp
    Filesize

    84KB

    Download
  • memory/1044-57-0x0000000075601000-0x0000000075603000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1304-60-0x0000000000000000-mapping.dmp
    Download
  • memory/1304-62-0x0000000000400000-0x0000000000415000-memory.dmp
    Filesize

    84KB

    Download