c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d

Analysis

max time kernel
36s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe
Size

104KB
MD5

4088f73f994529c0659b64d3527e4e2c
SHA1

004865f5f5997b310f57a874a4b60b0516e8f2ee
SHA256

c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d
SHA512

217a197a19257bbb0f9a35c6f6c2c8f552bb3cca6c5b57b5d74c536ef8d90e6d046e058c78d4aa5e0011ca2d71e2b9b81dd14d88b48d98bfa4d589f1d5576112
SSDEEP

1536:3oRG81Ltl1wia5XY7wfVWEm/QD/btVXL2wqLFeRGJqJdJNJnJIJVPhQjiOBDXFpt:181BwF5XYkIEmI/btVb2wqYRGhy8ZoJ

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2036	skkoy.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe
1672	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe
2036	skkoy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2036	1672	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe	27
PID 1672 wrote to memory of 2036	1672	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe	27
PID 1672 wrote to memory of 2036	1672	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe	27
PID 1672 wrote to memory of 2036	1672	c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe	27

C:\Users\Admin\AppData\Local\Temp\c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe
"C:\Users\Admin\AppData\Local\Temp\c4430243c2f28127a725c7ddc4ab2dedba633fa682070097708e4b088c88ce0d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\skkoy.exe
  "C:\Users\Admin\skkoy.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\skkoy.exe

Filesize
104KB

MD5
f3e5ed65a44dd783f79474ca0f29ce98

SHA1
214a0c199220507d2d423b4c94f8644c1ccbae17

SHA256
95a2dd94ce117e9bd605fdfe90a02b033b8ece5b15f7dedc681e4ca3f37f2337

SHA512
b72888a6a1d1e82b69dd3b98854238ced1ef84600d68607f9e0b937c4c27cd6af8a054695902e29c5c33c20288e0c4d4fd70836da2b446f3cd14581a85e27882

Download Submit
C:\Users\Admin\skkoy.exe

Filesize
104KB

MD5
f3e5ed65a44dd783f79474ca0f29ce98

SHA1
214a0c199220507d2d423b4c94f8644c1ccbae17

SHA256
95a2dd94ce117e9bd605fdfe90a02b033b8ece5b15f7dedc681e4ca3f37f2337

SHA512
b72888a6a1d1e82b69dd3b98854238ced1ef84600d68607f9e0b937c4c27cd6af8a054695902e29c5c33c20288e0c4d4fd70836da2b446f3cd14581a85e27882

Download Submit
\Users\Admin\skkoy.exe

Filesize
104KB

MD5
f3e5ed65a44dd783f79474ca0f29ce98

SHA1
214a0c199220507d2d423b4c94f8644c1ccbae17

SHA256
95a2dd94ce117e9bd605fdfe90a02b033b8ece5b15f7dedc681e4ca3f37f2337

SHA512
b72888a6a1d1e82b69dd3b98854238ced1ef84600d68607f9e0b937c4c27cd6af8a054695902e29c5c33c20288e0c4d4fd70836da2b446f3cd14581a85e27882

Download Submit
\Users\Admin\skkoy.exe

Filesize
104KB

MD5
f3e5ed65a44dd783f79474ca0f29ce98

SHA1
214a0c199220507d2d423b4c94f8644c1ccbae17

SHA256
95a2dd94ce117e9bd605fdfe90a02b033b8ece5b15f7dedc681e4ca3f37f2337

SHA512
b72888a6a1d1e82b69dd3b98854238ced1ef84600d68607f9e0b937c4c27cd6af8a054695902e29c5c33c20288e0c4d4fd70836da2b446f3cd14581a85e27882

Download Submit
memory/1672-56-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download