Analysis
- max time kernel
200s - max time network
204s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
29/11/2022, 08:05
Static task
static1
Behavioral task
behavioral1
Sample
86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe
- Size 206KB
- Sample221129-jy4cpsba29
- SHA256 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0
- MD5 f5b764006e015502f446355bd2cd5837
- SHA1 ea852ba3c342b9655d8c0bcf23ce981a4fe903d6
- SHA512 029784372828e0f07601bc317df9c654d309ca1f227c604ade85682ff060b0b335c5aae950ece2700f05c8e42a564644548f11df7d2dd27002be3b297659a4e7
- SSDEEP 3072:/ssu8L79GO3oQiibsJn537s++NwKmRmvFVboOiLVjeaA:/Xug79j3oQiibsJnh+NwKmRuVUHV5A
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\explorer.exe 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4564 wrote to memory of 3396 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 82 PID 4564 wrote to memory of 3396 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 82 PID 4564 wrote to memory of 3396 4564 86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe"C:\Users\Admin\AppData\Local\Temp\86a302f86f6ac3f57ba06264c54e55d5751c06afef93cde24edda13585a6beb0.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\windows\SysWOW64\explorer.exec:\windows\system32\explorer.exe2⤵
- Modifies registry class
PID:3396
-