Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/12/2022, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe
-
Size
128KB
-
MD5
3854e27aeaa78f6e89afe9fb8ff549c9
-
SHA1
e64d25a982649504c12588d7a2444a5b92b12d11
-
SHA256
1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9
-
SHA512
6fd4c5dca8388afaeb52132075f2a927152678ea289d335775a56caecc53cb16616a7729013ee4fccd2d49760ff4986b2084779c7989f166de5cfb7e517bedc0
-
SSDEEP
768:d1/Hda9ST28Xe04H7cHPHYmug6UXQm1dIZE2ocOT77e:dzqFHyj6S3T77
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mgrih.exe -
Executes dropped EXE 1 IoCs
pid Process 1472 mgrih.exe -
Loads dropped DLL 2 IoCs
pid Process 1644 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 1644 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ mgrih.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\mgrih = "C:\\Users\\Admin\\mgrih.exe" mgrih.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe 1472 mgrih.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1644 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 1472 mgrih.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 1472 1644 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 28 PID 1644 wrote to memory of 1472 1644 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 28 PID 1644 wrote to memory of 1472 1644 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 28 PID 1644 wrote to memory of 1472 1644 1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe 28 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27 PID 1472 wrote to memory of 1644 1472 mgrih.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe"C:\Users\Admin\AppData\Local\Temp\1038f51894de30e4906981a3de17f503791122fa6960d896921264408187f3f9.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\mgrih.exe"C:\Users\Admin\mgrih.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1472
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD590884701d392077b08b3d00723e44033
SHA141eff3f297ed067756c452319dd7378c02d1322f
SHA256eb7d46f272fcd560f6e6cc3ac4de556b16594db35473d845f38dda058f8f85d6
SHA512a50b28c8fcb31bca5caec1b71b5edbc424ef29db90601395ba20a094bd68d399adbb10c5d187aff33985e6b22c29db1f4f4a3cbb7ad2cad7b4383f2f5c93d476
-
Filesize
128KB
MD590884701d392077b08b3d00723e44033
SHA141eff3f297ed067756c452319dd7378c02d1322f
SHA256eb7d46f272fcd560f6e6cc3ac4de556b16594db35473d845f38dda058f8f85d6
SHA512a50b28c8fcb31bca5caec1b71b5edbc424ef29db90601395ba20a094bd68d399adbb10c5d187aff33985e6b22c29db1f4f4a3cbb7ad2cad7b4383f2f5c93d476
-
Filesize
128KB
MD590884701d392077b08b3d00723e44033
SHA141eff3f297ed067756c452319dd7378c02d1322f
SHA256eb7d46f272fcd560f6e6cc3ac4de556b16594db35473d845f38dda058f8f85d6
SHA512a50b28c8fcb31bca5caec1b71b5edbc424ef29db90601395ba20a094bd68d399adbb10c5d187aff33985e6b22c29db1f4f4a3cbb7ad2cad7b4383f2f5c93d476
-
Filesize
128KB
MD590884701d392077b08b3d00723e44033
SHA141eff3f297ed067756c452319dd7378c02d1322f
SHA256eb7d46f272fcd560f6e6cc3ac4de556b16594db35473d845f38dda058f8f85d6
SHA512a50b28c8fcb31bca5caec1b71b5edbc424ef29db90601395ba20a094bd68d399adbb10c5d187aff33985e6b22c29db1f4f4a3cbb7ad2cad7b4383f2f5c93d476