Analysis

  • max time kernel
    150s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 19:31

General

  • Target

    0d5060798b3f66722b66f0e1ad91c80c01086c1e7150e4534d7d26614420bfc1.exe

  • Size

    148KB

  • MD5

    1193a33ec8da0ed1c0dee19519079ed0

  • SHA1

    629fd623804dbe64f20298e91c2c2eea45ab3634

  • SHA256

    0d5060798b3f66722b66f0e1ad91c80c01086c1e7150e4534d7d26614420bfc1

  • SHA512

    b04e2b7c02d84dd7b3de80e34fce6c63623858af36c4fc783d984370c8433d5b5026ca381321ce912d8e784ba1749757a8b985e5965fdfe90770cc4e0e88f9e0

  • SSDEEP

    1536:FzIxU6wWnlhXcro1XxcazFABdFkouQ1KeCrhzra78rBkqhpMK/vIqXIVFSQaq9i9:jSlRcro1XaPBQo1MHksqqXIVFSQre1

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d5060798b3f66722b66f0e1ad91c80c01086c1e7150e4534d7d26614420bfc1.exe
    "C:\Users\Admin\AppData\Local\Temp\0d5060798b3f66722b66f0e1ad91c80c01086c1e7150e4534d7d26614420bfc1.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\rieduun.exe
      "C:\Users\Admin\rieduun.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:948

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\rieduun.exe

    Filesize

    148KB

    MD5

    9707df9f8ab299099fcf671f12f5d278

    SHA1

    b40fe16af3c1b4c986d0ec6a6984f27a142e9c7f

    SHA256

    04044c4c46d8ae51784b2b2af68e4ed8b3b3ae3eb804b5c14586806fa6b995aa

    SHA512

    411fd37577b93a9cb3e93f097ab89b93e6c443dd58bfbe8467c34b29e3b11987b275d8f19a955f7ea955471527ff1ae661af7c308111563cbc3a9024a6c771d4

  • C:\Users\Admin\rieduun.exe

    Filesize

    148KB

    MD5

    9707df9f8ab299099fcf671f12f5d278

    SHA1

    b40fe16af3c1b4c986d0ec6a6984f27a142e9c7f

    SHA256

    04044c4c46d8ae51784b2b2af68e4ed8b3b3ae3eb804b5c14586806fa6b995aa

    SHA512

    411fd37577b93a9cb3e93f097ab89b93e6c443dd58bfbe8467c34b29e3b11987b275d8f19a955f7ea955471527ff1ae661af7c308111563cbc3a9024a6c771d4

  • \Users\Admin\rieduun.exe

    Filesize

    148KB

    MD5

    9707df9f8ab299099fcf671f12f5d278

    SHA1

    b40fe16af3c1b4c986d0ec6a6984f27a142e9c7f

    SHA256

    04044c4c46d8ae51784b2b2af68e4ed8b3b3ae3eb804b5c14586806fa6b995aa

    SHA512

    411fd37577b93a9cb3e93f097ab89b93e6c443dd58bfbe8467c34b29e3b11987b275d8f19a955f7ea955471527ff1ae661af7c308111563cbc3a9024a6c771d4

  • \Users\Admin\rieduun.exe

    Filesize

    148KB

    MD5

    9707df9f8ab299099fcf671f12f5d278

    SHA1

    b40fe16af3c1b4c986d0ec6a6984f27a142e9c7f

    SHA256

    04044c4c46d8ae51784b2b2af68e4ed8b3b3ae3eb804b5c14586806fa6b995aa

    SHA512

    411fd37577b93a9cb3e93f097ab89b93e6c443dd58bfbe8467c34b29e3b11987b275d8f19a955f7ea955471527ff1ae661af7c308111563cbc3a9024a6c771d4

  • memory/948-66-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/948-71-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/1228-56-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/1228-64-0x0000000002D70000-0x0000000002D97000-memory.dmp

    Filesize

    156KB

  • memory/1228-65-0x0000000002D70000-0x0000000002D97000-memory.dmp

    Filesize

    156KB

  • memory/1228-57-0x0000000075A11000-0x0000000075A13000-memory.dmp

    Filesize

    8KB

  • memory/1228-69-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB

  • memory/1228-70-0x0000000002D70000-0x0000000002D97000-memory.dmp

    Filesize

    156KB