Analysis

  • max time kernel
    289s
  • max time network
    334s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2022 21:47

General

  • Target

    873e5ab44bdfafeb68254ed171e0fd7786f32b8ccea674d23a3106633767cd0e.exe

  • Size

    1.2MB

  • MD5

    432fbe7edf1488491374d9153438ef0e

  • SHA1

    653d39d795ec470f74b73c36394ef5b91d8e7998

  • SHA256

    873e5ab44bdfafeb68254ed171e0fd7786f32b8ccea674d23a3106633767cd0e

  • SHA512

    1b0f5b2a961aed40f8942f04f4c98e3b9427b90c7d88b65ee89344dac7a0cb58de697ea1869234f8caaf5d14ec8d42cc2e60d92a415abcfd0a97ca1799a75556

  • SSDEEP

    24576:zj8xJJLICP5YKJNuWJsGEdX+YTbdsEMeSNbBhOxMMz9LZibsTUMqN:v0uuufHdhQgtZiCLqN

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\873e5ab44bdfafeb68254ed171e0fd7786f32b8ccea674d23a3106633767cd0e.exe
    "C:\Users\Admin\AppData\Local\Temp\873e5ab44bdfafeb68254ed171e0fd7786f32b8ccea674d23a3106633767cd0e.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of SetWindowsHookEx
    PID:1488

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1488-54-0x0000000000400000-0x00000000007833A4-memory.dmp

    Filesize

    3.5MB

  • memory/1488-55-0x0000000076771000-0x0000000076773000-memory.dmp

    Filesize

    8KB

  • memory/1488-56-0x0000000000400000-0x00000000007833A4-memory.dmp

    Filesize

    3.5MB

  • memory/1488-57-0x0000000002550000-0x0000000002560000-memory.dmp

    Filesize

    64KB

  • memory/1488-58-0x0000000002550000-0x0000000002560000-memory.dmp

    Filesize

    64KB

  • memory/1488-59-0x0000000000400000-0x00000000007833A4-memory.dmp

    Filesize

    3.5MB

  • memory/1488-60-0x0000000000400000-0x00000000007833A4-memory.dmp

    Filesize

    3.5MB

  • memory/1488-61-0x0000000002550000-0x0000000002560000-memory.dmp

    Filesize

    64KB

  • memory/1488-62-0x0000000002550000-0x0000000002560000-memory.dmp

    Filesize

    64KB