Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 03:02
Static task
static1
Behavioral task
behavioral1
Sample
b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe
-
Size
215KB
-
MD5
5d4950fd6fdc7faadf360fcfc84f7690
-
SHA1
414d525746d589576466433491ac5c0b660040e6
-
SHA256
b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f
-
SHA512
9b849a55e63b1269b18f38a4bd928310a079ca5e1b3d13952d98107997e7311e249f8838d8f9b788f9830d4fb9ffa418b9c77ac0fa762320d76f34f3dd6f2ce3
-
SSDEEP
6144:aJ4ksCZslwNvqFrCip2XXx+y9t9iuZQuU29Dy:FksaslWErPp2XLDICnf9
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/532-133-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral2/memory/4848-134-0x0000000000400000-0x0000000000490000-memory.dmp upx behavioral2/memory/4848-135-0x0000000000400000-0x0000000000490000-memory.dmp upx -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\fktOOOt@8oo_vxy fktOOOt@8oo_vxy.exe File opened for modification C:\PROGRA~3\fktOOOt@8oo_vxy fktOOOt@8oo_vxy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fktOOOt@8oo_vxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString fktOOOt@8oo_vxy.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main fktOOOt@8oo_vxy.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" fktOOOt@8oo_vxy.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 532 b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4848 fktOOOt@8oo_vxy.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 532 b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe 4848 fktOOOt@8oo_vxy.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 532 wrote to memory of 4848 532 b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe 79 PID 532 wrote to memory of 4848 532 b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe 79 PID 532 wrote to memory of 4848 532 b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe"C:\Users\Admin\AppData\Local\Temp\b08ca0119db48658be86a4d7983ef0417b3c26f88b21d287504ddab5423b4b9f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:532 -
C:\PROGRA~3\fktOOOt@8oo_vxy.exeC:\PROGRA~3\fktOOOt@8oo_vxy.exe2⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4848
-