Overview

overview

6

Static

static

bf6fb09da3...dd.exe

windows7-x64

6

bf6fb09da3...dd.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    103s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-12-2022 06:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd.exe

  • Size

    36KB

  • MD5

    f619c1e3829b40ae4c8175ca75f8ef31

  • SHA1

    85a193c4e681924247a3bd3165521466b9a17347

  • SHA256

    bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd

  • SHA512

    ca02acdd0237c8076c5a123ea01bb6bb7e27733cb8a6ff3829519f97771d75542e6f8eef0a7f3e2564276b3f2e17a7fd600e6cb7934a55e27bbe9cb329af88cd

  • SSDEEP

    384:Fg2Q5RCxRtY9LYf685qgxUhYcgbZe67TIW0DsSAR:NQyTtWLC68MvmcghHOLA

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd.exe
    "C:\Users\Admin\AppData\Local\Temp\bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Windows\Cursors\bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd.exe
      C:\Windows\Cursors\bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd.exe
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5004
  • C:\Windows\Cursors\bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd.exe
    C:\Windows\Cursors\bf6fb09da38347d2b68691919a9cf6f9dbaacf318e75cfb2305d3618f80d34dd.exe
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4572

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5004-134-0x0000000000000000-mapping.dmp

    Download