bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe
Size

60KB
MD5

8636262955ed827bb3dbdd40a056b44f
SHA1

4d52306860b5b2d8af004984a5374294da0e2720
SHA256

bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a
SHA512

4753bea0634781080f002ad2523afce14e7c3b76b8f161778aeef546c3be10896ec4e54f50bf59ada1cec746e11a85984b6737c84d74868137159ad0f05de99b
SSDEEP

768:wQRNnviL/VEC0KnQBnZleQBkIBFRt6cqLkE/eun7rALCntctJGmxmAR4I9VtW:ZyPQnQQBkIBFLakEaLCntfblI9

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\OO6ZCDBH.exe	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe
File opened for modification	C:\Windows\OO6ZCDBH.exe	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1720	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe
1720	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe
1720	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe
1720	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe
1720	bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe

C:\Users\Admin\AppData\Local\Temp\bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe
"C:\Users\Admin\AppData\Local\Temp\bf1d99210de622511d2fe11808241c59002613b4849706a860c7684e93a5fa1a.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads