Analysis

  • max time kernel
    233s
  • max time network
    337s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 13:13

General

  • Target

    116efe49c5cdd34ffe1094a74c36f5141d813c9c609776be9eca512d21e1f703.exe

  • Size

    2.8MB

  • MD5

    669a23b5dbc0d0c04d426605c1ec64bd

  • SHA1

    e7aef403ded8a9293a1e0a10967b8e99999bdf1c

  • SHA256

    116efe49c5cdd34ffe1094a74c36f5141d813c9c609776be9eca512d21e1f703

  • SHA512

    cbd8a192da003868b1e11cefc334edab6a60945844d88678d1aa8977e7ab00d19443184bdcc6d2e695e1a1078966848ebfc85c89b7a0c5babbc4ab18b16a79c7

  • SSDEEP

    49152:O/5XNsG7W8KVyOi131kzUqx502iWaEnu65KVUVg:OoGKm13+z7iLEN

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\116efe49c5cdd34ffe1094a74c36f5141d813c9c609776be9eca512d21e1f703.exe
    "C:\Users\Admin\AppData\Local\Temp\116efe49c5cdd34ffe1094a74c36f5141d813c9c609776be9eca512d21e1f703.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:468

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/468-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

    Filesize

    8KB

  • memory/468-55-0x0000000000400000-0x00000000009AB000-memory.dmp

    Filesize

    5.7MB

  • memory/468-56-0x0000000000400000-0x00000000009AB000-memory.dmp

    Filesize

    5.7MB

  • memory/468-57-0x0000000000400000-0x00000000009AB000-memory.dmp

    Filesize

    5.7MB

  • memory/468-58-0x0000000000400000-0x00000000009AB000-memory.dmp

    Filesize

    5.7MB

  • memory/468-59-0x0000000000400000-0x00000000009AB000-memory.dmp

    Filesize

    5.7MB

  • memory/468-60-0x0000000000400000-0x00000000009AB000-memory.dmp

    Filesize

    5.7MB