Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 18:03
Static task
static1
Behavioral task
behavioral1
Sample
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe
Resource
win7-20220812-en
General
-
Target
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe
-
Size
244KB
-
MD5
73a62d9879926cc9e6d46a172c8c7ee6
-
SHA1
4f748aa60caf62469492856a99053514b65b1e94
-
SHA256
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3
-
SHA512
f2aace748be4dc1f330abce4f4a65ee1f29242a49b3759469304a28ca379f989c215da6a94ee2a2f234c6cc76629e5dcd23e8f137e905a2713ff73c2e9b6b009
-
SSDEEP
6144:6b/t2ebYNZtTck5NIG69kA9EgD5j6xzD:o/tKRc0bkFEMjO
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exef73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exemousemetagen.exemousemetagen.exepid process 4264 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 4264 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 1360 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 1360 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe 4696 mousemetagen.exe 4696 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe 376 mousemetagen.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exepid process 1360 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exemousemetagen.exedescription pid process target process PID 4264 wrote to memory of 1360 4264 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe PID 4264 wrote to memory of 1360 4264 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe PID 4264 wrote to memory of 1360 4264 f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe PID 4696 wrote to memory of 376 4696 mousemetagen.exe mousemetagen.exe PID 4696 wrote to memory of 376 4696 mousemetagen.exe mousemetagen.exe PID 4696 wrote to memory of 376 4696 mousemetagen.exe mousemetagen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"C:\Users\Admin\AppData\Local\Temp\f73818d00fc14af6af90e67f2a44643b35103f02f4daaa7f15a5d2b1bbf40ff3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\SysWOW64\mousemetagen.exe"C:\Windows\SysWOW64\mousemetagen.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mousemetagen.exe"C:\Windows\SysWOW64\mousemetagen.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/376-164-0x0000000000AD0000-0x0000000000AEA000-memory.dmpFilesize
104KB
-
memory/376-160-0x0000000000AF0000-0x0000000000B0A000-memory.dmpFilesize
104KB
-
memory/376-162-0x0000000000AD0000-0x0000000000AEA000-memory.dmpFilesize
104KB
-
memory/376-163-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/376-155-0x0000000000AF0000-0x0000000000B0A000-memory.dmpFilesize
104KB
-
memory/376-153-0x0000000000000000-mapping.dmp
-
memory/1360-142-0x00000000005F0000-0x000000000060A000-memory.dmpFilesize
104KB
-
memory/1360-145-0x00000000005B0000-0x00000000005CA000-memory.dmpFilesize
104KB
-
memory/1360-146-0x00000000005D0000-0x00000000005E0000-memory.dmpFilesize
64KB
-
memory/1360-147-0x00000000005B0000-0x00000000005CA000-memory.dmpFilesize
104KB
-
memory/1360-161-0x00000000005B0000-0x00000000005CA000-memory.dmpFilesize
104KB
-
memory/1360-139-0x00000000005F0000-0x000000000060A000-memory.dmpFilesize
104KB
-
memory/1360-137-0x0000000000000000-mapping.dmp
-
memory/4264-132-0x0000000000720000-0x000000000073A000-memory.dmpFilesize
104KB
-
memory/4264-144-0x0000000000740000-0x0000000000750000-memory.dmpFilesize
64KB
-
memory/4264-143-0x0000000000700000-0x000000000071A000-memory.dmpFilesize
104KB
-
memory/4264-136-0x0000000000720000-0x000000000073A000-memory.dmpFilesize
104KB
-
memory/4696-148-0x0000000000D50000-0x0000000000D6A000-memory.dmpFilesize
104KB
-
memory/4696-154-0x00000000005C0000-0x00000000005DA000-memory.dmpFilesize
104KB
-
memory/4696-157-0x0000000000D70000-0x0000000000D80000-memory.dmpFilesize
64KB
-
memory/4696-152-0x0000000000D50000-0x0000000000D6A000-memory.dmpFilesize
104KB