c0798b8eb7871a84f6a8d927326e9d269ecdcf7635e932a635c17ae478146f75

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0798b8eb7871a84f6a8d927326e9d269ecdcf7635e932a635c17ae478146f75.exe
Size

172KB
MD5

4a4fa9afa45ec34c08bfd89698c16415
SHA1

bc3535befd8e767dabf39df379ec4b31cb3b1920
SHA256

c0798b8eb7871a84f6a8d927326e9d269ecdcf7635e932a635c17ae478146f75
SHA512

d2a96afb33d5a2a2998c5007af313f2b49b8e2d100caef9bcf2cc9b7ec95fbd0ef0259c482452e41ab6bcf493552e990c013dd5a4f8fc8512e0262219ae71325
SSDEEP

3072:APv8hnEt5qwqYXsydmYaDe29TDEbWPt/M2vJa6A9R8QKWRG1GGzEScZ2qdW:aU5+qweydm5t02vJrhkGQOEScPW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1616	DllHost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2000	c0798b8eb7871a84f6a8d927326e9d269ecdcf7635e932a635c17ae478146f75.exe

C:\Users\Admin\AppData\Local\Temp\c0798b8eb7871a84f6a8d927326e9d269ecdcf7635e932a635c17ae478146f75.exe
"C:\Users\Admin\AppData\Local\Temp\c0798b8eb7871a84f6a8d927326e9d269ecdcf7635e932a635c17ae478146f75.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2000

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Índice.jpeg

Filesize
3KB

MD5
4ce000f3c2525e6aace35463e4e5bda6

SHA1
2ec151e0ca674061cd790046b27ca9adf2c17668

SHA256
02eed98b7ba40266bd853d58b9842a1a1a989d3263eebf43de4f84de9709fe21

SHA512
bd7ab7048d8270666995744faeaa41f5cf1b1fcb32e25ea9b2c757aff2dd5749f0c701be9c60d8b5af20ad49f12c060ae701d66cb7b2828eb24975cebec19bfe

Download Submit
memory/2000-56-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download