Analysis

  • max time kernel
    152s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 23:29

General

  • Target

    e24a7f03955fefa223517617fef8b22eb7bc85e3a47fab35b0fd51ef71442407.exe

  • Size

    136KB

  • MD5

    decf9d9242ccfbf4241ad90325fe1c2a

  • SHA1

    c7aafedb021b240a8f5ee2b40756b9156ae889db

  • SHA256

    e24a7f03955fefa223517617fef8b22eb7bc85e3a47fab35b0fd51ef71442407

  • SHA512

    7d9697dfd073466c550a80834a0136d95c0344c52b37ee9f62986898278adaa5c7dbf416cee5014b8b5fc3c9de1181383d4b2fc48764eb89b664a2a5772fa8cb

  • SSDEEP

    3072:MpTJovvXFwRBW1cQoj9MYuPCNtrK6tJTVUa37hmeK:qu/d2QRYjfTVU40e

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 52 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e24a7f03955fefa223517617fef8b22eb7bc85e3a47fab35b0fd51ef71442407.exe
    "C:\Users\Admin\AppData\Local\Temp\e24a7f03955fefa223517617fef8b22eb7bc85e3a47fab35b0fd51ef71442407.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Users\Admin\ruuifuw.exe
      "C:\Users\Admin\ruuifuw.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:520

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\ruuifuw.exe

          Filesize

          136KB

          MD5

          026e63d070f91ce849c795a1e6c35275

          SHA1

          91fcf8f734173c1d1b8b2e35e90ebc22d8776b64

          SHA256

          b4427c6209a43e3c43b2bbaa714ad72c468397d77697be9a4b08f1dc270ad85c

          SHA512

          1a0a692a70fa14b208034807fa6c7f0303b0953abe81d3e6431c3bee13e0015b9e021b31b32986f04f74337a94cfde0a1dd62e271e3932f7c101d748056db5b5

        • C:\Users\Admin\ruuifuw.exe

          Filesize

          136KB

          MD5

          026e63d070f91ce849c795a1e6c35275

          SHA1

          91fcf8f734173c1d1b8b2e35e90ebc22d8776b64

          SHA256

          b4427c6209a43e3c43b2bbaa714ad72c468397d77697be9a4b08f1dc270ad85c

          SHA512

          1a0a692a70fa14b208034807fa6c7f0303b0953abe81d3e6431c3bee13e0015b9e021b31b32986f04f74337a94cfde0a1dd62e271e3932f7c101d748056db5b5

        • \Users\Admin\ruuifuw.exe

          Filesize

          136KB

          MD5

          026e63d070f91ce849c795a1e6c35275

          SHA1

          91fcf8f734173c1d1b8b2e35e90ebc22d8776b64

          SHA256

          b4427c6209a43e3c43b2bbaa714ad72c468397d77697be9a4b08f1dc270ad85c

          SHA512

          1a0a692a70fa14b208034807fa6c7f0303b0953abe81d3e6431c3bee13e0015b9e021b31b32986f04f74337a94cfde0a1dd62e271e3932f7c101d748056db5b5

        • \Users\Admin\ruuifuw.exe

          Filesize

          136KB

          MD5

          026e63d070f91ce849c795a1e6c35275

          SHA1

          91fcf8f734173c1d1b8b2e35e90ebc22d8776b64

          SHA256

          b4427c6209a43e3c43b2bbaa714ad72c468397d77697be9a4b08f1dc270ad85c

          SHA512

          1a0a692a70fa14b208034807fa6c7f0303b0953abe81d3e6431c3bee13e0015b9e021b31b32986f04f74337a94cfde0a1dd62e271e3932f7c101d748056db5b5

        • memory/864-56-0x0000000076261000-0x0000000076263000-memory.dmp

          Filesize

          8KB