Analysis
-
max time kernel
186s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 10:45
Static task
static1
Behavioral task
behavioral1
Sample
8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe
Resource
win10v2004-20220812-en
General
-
Target
8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe
-
Size
2.8MB
-
MD5
e01a7eb83f3646f718289fd9a2e2f9b7
-
SHA1
7601e25fa2bb9bddf9b19d97350c29f62363cdfa
-
SHA256
8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98
-
SHA512
2329021bfa56b17841d6fa8bb14ad2c481c70c231b3a8149010125474d0e319ed77888eded2e853a43284eef03549b08fd2c77995ec26c64d376d5b4bab27e7a
-
SSDEEP
49152:vShyKlJ94eMuKWQc7z7GDmi2SzZrcIp1lDsWGu/aaAPxsUaeyz:vKlzTcyHKmirrceHHAakx2ek
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 948 8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe 948 8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe 948 8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe 948 8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 948 8dcfdb615e807d178723bab2c37684c21f5430605c6dfd396abcb6dddac94e98.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
21KB
MD54b2ac1ce1a2d71e9655a92afb8f8c76b
SHA18d5086a8195e95d72667d6c7707778750ead5cdc
SHA256b7481b29387fbc83ea24684919fec44eedb054d70dc7d4af81394f22184d1142
SHA512b988bbc1d34e270736c073d2a2be7650c41f7d70d58671115665e48f19e8a8826f6c6e2d340ca7c82d6dd86e9c045acb9658bd4865ffd2ef71b596a7bd993ea4