Analysis
-
max time kernel
153s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 04:48
Static task
static1
Behavioral task
behavioral1
Sample
44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe
-
Size
337KB
-
MD5
15a786b1ef0a0df25f31d5f137c75344
-
SHA1
dbd5f47a0e37913bf3846e37b7971cb36f9735b9
-
SHA256
44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4
-
SHA512
d54fd775e2f46efe5a2fbd999eb7c8a635a793d34b040a18f906301e6b9a7c0353957655ea7de20d30a6afa43b395c5707540f131cb8f73bb019a09329b3c2e2
-
SSDEEP
6144:0dD+O3ld3xTLo1KBujL4adYOWFPA/dwP4zpxL7K3ZqTq2+NjnxYD39tHWPqBICG:YRvxo003TcIpEqO2Mx039RWPqr
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4928-132-0x0000000000400000-0x00000000004D4000-memory.dmp upx behavioral2/memory/1056-136-0x0000000000400000-0x00000000004D4000-memory.dmp upx -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\z8yx334pSZNjOw z8yx334pSZNjOw.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main z8yx334pSZNjOw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes" z8yx334pSZNjOw.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4928 44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1056 z8yx334pSZNjOw.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4928 44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe 1056 z8yx334pSZNjOw.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4928 wrote to memory of 1056 4928 44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe 80 PID 4928 wrote to memory of 1056 4928 44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe 80 PID 4928 wrote to memory of 1056 4928 44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe"C:\Users\Admin\AppData\Local\Temp\44109a210d76a133eb102a0bc43ce3eaecbf84291153565feb048a9e506ebed4.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\PROGRA~3\z8yx334pSZNjOw.exeC:\PROGRA~3\z8yx334pSZNjOw.exe2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1056
-