Analysis

  • max time kernel
    153s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 18:16

General

  • Target

    db3cce7ac2518914afbea516e9968757046f028c4fee92617e082a45c589383e.exe

  • Size

    135KB

  • MD5

    4ab5b40249eee078e2ddb37f2f901660

  • SHA1

    cbdb30321ed14f94042df3ea6b9091acd72f4fa6

  • SHA256

    db3cce7ac2518914afbea516e9968757046f028c4fee92617e082a45c589383e

  • SHA512

    10073491ce86d17849f1ca7cae386f00f7509b5661b25a2dace6345bc2b01cba0686a3c99407fe8e57ba1887fafc502033cc9bcec6db0d530802775fb98e3dfa

  • SSDEEP

    3072:KAaJdc3VsweCeXRzeSeVeEe0eDQ8jrTrm:raJdc3VsZR3Q8jrTr

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\db3cce7ac2518914afbea516e9968757046f028c4fee92617e082a45c589383e.exe
    "C:\Users\Admin\AppData\Local\Temp\db3cce7ac2518914afbea516e9968757046f028c4fee92617e082a45c589383e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Users\Admin\ydfiv.exe
      "C:\Users\Admin\ydfiv.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\ydfiv.exe

    Filesize

    135KB

    MD5

    a000cc30177f0587f2bb595a3e45da1f

    SHA1

    b8588867af37c277229b8eb5d95206253fe320ef

    SHA256

    8d71ffd6a39aa504e7ed66198b0538be5a9acc6372e10c315e473349c22c9cd1

    SHA512

    dc3dd33091c2dbb6144ba6a69eed95b484a6f0ac9acb6faf59780beae1ca58ae499c18d14e0eac9cb2e10b80bf3b9a475308a97be07a6fe5a063c971abd37324

  • C:\Users\Admin\ydfiv.exe

    Filesize

    135KB

    MD5

    a000cc30177f0587f2bb595a3e45da1f

    SHA1

    b8588867af37c277229b8eb5d95206253fe320ef

    SHA256

    8d71ffd6a39aa504e7ed66198b0538be5a9acc6372e10c315e473349c22c9cd1

    SHA512

    dc3dd33091c2dbb6144ba6a69eed95b484a6f0ac9acb6faf59780beae1ca58ae499c18d14e0eac9cb2e10b80bf3b9a475308a97be07a6fe5a063c971abd37324

  • \Users\Admin\ydfiv.exe

    Filesize

    135KB

    MD5

    a000cc30177f0587f2bb595a3e45da1f

    SHA1

    b8588867af37c277229b8eb5d95206253fe320ef

    SHA256

    8d71ffd6a39aa504e7ed66198b0538be5a9acc6372e10c315e473349c22c9cd1

    SHA512

    dc3dd33091c2dbb6144ba6a69eed95b484a6f0ac9acb6faf59780beae1ca58ae499c18d14e0eac9cb2e10b80bf3b9a475308a97be07a6fe5a063c971abd37324

  • \Users\Admin\ydfiv.exe

    Filesize

    135KB

    MD5

    a000cc30177f0587f2bb595a3e45da1f

    SHA1

    b8588867af37c277229b8eb5d95206253fe320ef

    SHA256

    8d71ffd6a39aa504e7ed66198b0538be5a9acc6372e10c315e473349c22c9cd1

    SHA512

    dc3dd33091c2dbb6144ba6a69eed95b484a6f0ac9acb6faf59780beae1ca58ae499c18d14e0eac9cb2e10b80bf3b9a475308a97be07a6fe5a063c971abd37324

  • memory/1368-56-0x0000000075931000-0x0000000075933000-memory.dmp

    Filesize

    8KB