Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
05-12-2022 09:24
General
-
Target
ab6a767e1c52b69ed14102dc664f7496322796add2b9dacbb3ea84045a2934a7.exe
-
Size
126KB
-
MD5
91e5bf64c9c8c4332cf188efb7de80d0
-
SHA1
fb8562f2a8d84b6e0c411c381fe64383f6a7e475
-
SHA256
ab6a767e1c52b69ed14102dc664f7496322796add2b9dacbb3ea84045a2934a7
-
SHA512
0749c89d0cfe91f6c7c474aed05f16b7f41cbfffda4e5f3408c490e11d9c4da741a458b8d91f95f574c252cbeb502ba8d833d0731e59ab744aacfb4001314895
-
SSDEEP
3072:8dwEcppl69FPQpNPQ6//sdFLvQeiN32++6xU+fh370k3hdAf:imppl69Q//sGF+Kp170k3hY
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab6a767e1c52b69ed14102dc664f7496322796add2b9dacbb3ea84045a2934a7.exe"C:\Users\Admin\AppData\Local\Temp\ab6a767e1c52b69ed14102dc664f7496322796add2b9dacbb3ea84045a2934a7.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\r.execmd /c "C:\Program Files (x86)\r.exe240546953na.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\r.exe240546953na.exe"C:\Program Files (x86)\r.exe240546953na.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
231KB
MD5d0fce3afa6aa1d58ce9fa336cc2b675b
SHA14048488de6ba4bfef9edf103755519f1f762668f
SHA2564d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
SHA51280e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2
-
Filesize
114KB
MD5cec0558edd55364d25e7a5f690352776
SHA1185e0704fecd0f96467aff3b5cb7db5c32895a4c
SHA256537c6aeff3e5fefcd1b55920b6662261a579ea753540193295c872454760ad3a
SHA5121091286fada69f5ea29adada4751f9530bbd9636c09e77b8f66d81910ff0350be3e450487b1867e8c2b66bbbfffeec9f56ee764162cfb9571c3051571977a7f8
-
Filesize
114KB
MD5cec0558edd55364d25e7a5f690352776
SHA1185e0704fecd0f96467aff3b5cb7db5c32895a4c
SHA256537c6aeff3e5fefcd1b55920b6662261a579ea753540193295c872454760ad3a
SHA5121091286fada69f5ea29adada4751f9530bbd9636c09e77b8f66d81910ff0350be3e450487b1867e8c2b66bbbfffeec9f56ee764162cfb9571c3051571977a7f8
-
Filesize
132KB
-
Filesize
120KB