Analysis
-
max time kernel
80s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06/12/2022, 13:21
General
-
Target
0f277a92d03fd8f1847287e0e893b2805dd808f1096b302fd5a1736af8c27246.exe
-
Size
1.3MB
-
MD5
5c1817c4b51dcde5a9cae3cda54e50c4
-
SHA1
80dcd24115ff9e5f7a0c136401372ad3396d470c
-
SHA256
0f277a92d03fd8f1847287e0e893b2805dd808f1096b302fd5a1736af8c27246
-
SHA512
e6919d4c9c4f517eb515168feae9a84b87211e43c4da7b7200684d25c5a76d4af4d8d6e1aeb3ce4b2753bea29fd1f1c235cc8af0ea4a859b51d0bd78c2edbe26
-
SSDEEP
24576:FRZmKckCiocZsvXDB978O0FZX8piprmmWw5EUpM4KPUbb6C5DzG7w:FRZgViocYl9776prlhFKPkbl9G7
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies Internet Explorer start page 1 TTPs 1 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f277a92d03fd8f1847287e0e893b2805dd808f1096b302fd5a1736af8c27246.exe"C:\Users\Admin\AppData\Local\Temp\0f277a92d03fd8f1847287e0e893b2805dd808f1096b302fd5a1736af8c27246.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB