f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e

Analysis

max time kernel
174s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26-11-2022 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe
Size

150KB
MD5

54c71c18183ef05b38143473d5fa486c
SHA1

8adec4c1367c8f580f68e47b26c2f2ef9d51f494
SHA256

f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e
SHA512

e8456b6783a98bfda0ee8c45da3b6482a996eebcda7743180e66d875b520d37863a81685754b8733360f4ca7567d3d351f27bcfe316a31a10c3bc420ad91c2d4
SSDEEP

3072:MBmpqM2kO7XGVSQPwqCC+SXwHIlike8pDUvYDGOzubx:MCU1WVSyl+SK0ik5hqOzubx

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\syotom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe"	f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe

pid process

728 f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
728	f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe

C:\Users\Admin\AppData\Local\Temp\f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe
"C:\Users\Admin\AppData\Local\Temp\f35af41109c4192f60a4022b39789e730fdaf67d77b10d7b90304d53519ff74e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/728-132-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/728-133-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download