Analysis
-
max time kernel
201s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
04/12/2022, 13:07
General
-
Target
e74de580b480b90f9f59d37e9e2f260d3afabfc8f665e1f58898f34def920662.exe
-
Size
841KB
-
MD5
078e1b72d78867f00b575e43304c6770
-
SHA1
2312f5ca712c577ccf9a1e20699569a0ed53d0e7
-
SHA256
e74de580b480b90f9f59d37e9e2f260d3afabfc8f665e1f58898f34def920662
-
SHA512
7c7cbbc48cb3d646678f01ee0d56683db1396d70a47b18bc7bcc6b34f3cfc00bef995f451f8720dda37d71ca8f31a7104a9eda381467c799b3998ac5a57ae9ef
-
SSDEEP
24576:CqVk+j02nRENz5sEERIRLY+aPtul1aqr:CqVtREzKaY+aPYLaqr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of FindShellTrayWindow 13 IoCs
-
Suspicious use of SendNotifyMessage 13 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e74de580b480b90f9f59d37e9e2f260d3afabfc8f665e1f58898f34def920662.exe"C:\Users\Admin\AppData\Local\Temp\e74de580b480b90f9f59d37e9e2f260d3afabfc8f665e1f58898f34def920662.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\mldefender.exeC:\ProgramData\mldefender.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
820KB
MD55aeba985247ac15a42f4054230094920
SHA1b01bfe87d073a393a8a2813d0a4a87355341a0ee
SHA25663b7c5f80e935521dbd0fd1ab584fc386fefd6a44109b38b0913f2c2c0fd2483
SHA5122d88add462e21ffec5d68613c2f31230a8373673f8763c511bc0fb301e3181156a07f98821c2fcd8e8bdab99db9ba99e3a8d301c678505b514f5e8b779a2342e
-
Filesize
820KB
MD55aeba985247ac15a42f4054230094920
SHA1b01bfe87d073a393a8a2813d0a4a87355341a0ee
SHA25663b7c5f80e935521dbd0fd1ab584fc386fefd6a44109b38b0913f2c2c0fd2483
SHA5122d88add462e21ffec5d68613c2f31230a8373673f8763c511bc0fb301e3181156a07f98821c2fcd8e8bdab99db9ba99e3a8d301c678505b514f5e8b779a2342e
-
Filesize
820KB
MD55aeba985247ac15a42f4054230094920
SHA1b01bfe87d073a393a8a2813d0a4a87355341a0ee
SHA25663b7c5f80e935521dbd0fd1ab584fc386fefd6a44109b38b0913f2c2c0fd2483
SHA5122d88add462e21ffec5d68613c2f31230a8373673f8763c511bc0fb301e3181156a07f98821c2fcd8e8bdab99db9ba99e3a8d301c678505b514f5e8b779a2342e
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
8KB
-
Filesize
868KB
-
Filesize
868KB