a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a

Analysis

max time kernel
340s
max time network
394s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 15:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe
Size

93KB
MD5

68a61ca1554b4cef07ce9a3bfd6b9420
SHA1

f021e2be271e5f53536f362880b797b3d959f037
SHA256

a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a
SHA512

97d93b8e17aae938d82ab790fb65f72ec9e2e48fddbf04ce1bde23be41af465ae27e5012b0850a3a8a11ee63bc34a8913bec0110ef8ec9d1b03439f3cba2bf79
SSDEEP

1536:umPBKFKlazNAAwbXqrJSNgw27tNfYH16Me:JPBKFoazN0q0v2xG12

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4640	OpenWith.exe

C:\Users\Admin\AppData\Local\Temp\a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe
"C:\Users\Admin\AppData\Local\Temp\a9ed1da6c74b108e8851308c19964d107dffba25b2bb5e126b3080c058f9d70a.exe"
1⤵
- Modifies registry class
PID:1016

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-132-0x0000000074820000-0x0000000074DD1000-memory.dmp

Filesize
5.7MB

Download
memory/1016-133-0x0000000074820000-0x0000000074DD1000-memory.dmp

Filesize
5.7MB

Download
memory/1016-134-0x0000000074820000-0x0000000074DD1000-memory.dmp

Filesize
5.7MB

Download