Overview

overview

10

Static

static

fc5f7e1cf7...8b.exe

windows7-x64

10

fc5f7e1cf7...8b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 23:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc5f7e1cf7f91f7796e7a83263dc187dfdced4f86328e9040fbbe514a551b38b.exe

  • Size

    260KB

  • MD5

    3cbfef3954fae70657a9290db4f8a4b7

  • SHA1

    a3365bcf6fb16961db15a168e4101942d770858d

  • SHA256

    fc5f7e1cf7f91f7796e7a83263dc187dfdced4f86328e9040fbbe514a551b38b

  • SHA512

    51ce7eae3c095eb09093109e04804faf826d5118530f0d92b8d361d142aecc6f80d2012479c2aa04107dfe6ee3638b6ad8477fa7345b93f9f6706957f18f9719

  • SSDEEP

    6144:ndT/dQgTSrMaIl/jcLijfHFEHWzXvjT85R:nl7TSrMaIqLlI/H85R

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 53 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc5f7e1cf7f91f7796e7a83263dc187dfdced4f86328e9040fbbe514a551b38b.exe
    "C:\Users\Admin\AppData\Local\Temp\fc5f7e1cf7f91f7796e7a83263dc187dfdced4f86328e9040fbbe514a551b38b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\geutoud.exe
      "C:\Users\Admin\geutoud.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\geutoud.exe
    Filesize

    260KB

    MD5

    9eeed2ed55d45efecef5963228fe8b21

    SHA1

    b7f29beb476e32953e448548738ba9766269dffb

    SHA256

    1c45987c2ef9d2c3a4d2aeb7b64d5e99c4ea8251963d40a2155f3b07868e76a4

    SHA512

    8d334d4dad3316cee16c8f9402ad6b5b99726286cfd9e13da4a4622ce2c5100b71eddf6e823200621a340391ada96e25835935f17ab8136242c681b451f88ed2

    Download Submit

  • C:\Users\Admin\geutoud.exe
    Filesize

    260KB

    MD5

    9eeed2ed55d45efecef5963228fe8b21

    SHA1

    b7f29beb476e32953e448548738ba9766269dffb

    SHA256

    1c45987c2ef9d2c3a4d2aeb7b64d5e99c4ea8251963d40a2155f3b07868e76a4

    SHA512

    8d334d4dad3316cee16c8f9402ad6b5b99726286cfd9e13da4a4622ce2c5100b71eddf6e823200621a340391ada96e25835935f17ab8136242c681b451f88ed2

    Download Submit

  • \Users\Admin\geutoud.exe
    Filesize

    260KB

    MD5

    9eeed2ed55d45efecef5963228fe8b21

    SHA1

    b7f29beb476e32953e448548738ba9766269dffb

    SHA256

    1c45987c2ef9d2c3a4d2aeb7b64d5e99c4ea8251963d40a2155f3b07868e76a4

    SHA512

    8d334d4dad3316cee16c8f9402ad6b5b99726286cfd9e13da4a4622ce2c5100b71eddf6e823200621a340391ada96e25835935f17ab8136242c681b451f88ed2

    Download Submit

  • \Users\Admin\geutoud.exe
    Filesize

    260KB

    MD5

    9eeed2ed55d45efecef5963228fe8b21

    SHA1

    b7f29beb476e32953e448548738ba9766269dffb

    SHA256

    1c45987c2ef9d2c3a4d2aeb7b64d5e99c4ea8251963d40a2155f3b07868e76a4

    SHA512

    8d334d4dad3316cee16c8f9402ad6b5b99726286cfd9e13da4a4622ce2c5100b71eddf6e823200621a340391ada96e25835935f17ab8136242c681b451f88ed2

    Download Submit

  • memory/1980-56-0x0000000076031000-0x0000000076033000-memory.dmp

    Filesize

    8KB

    Download