Analysis
-
max time kernel
41s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
14-12-2022 18:42
Static task
static1
Behavioral task
behavioral1
Sample
DatabaseNDA-14310.lnk
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
DatabaseNDA-14310.lnk
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
desktop.dll
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
desktop.dll
Resource
win10v2004-20220812-en
General
-
Target
DatabaseNDA-14310.lnk
-
Size
2KB
-
MD5
91d36dfa00a703fa9ad73d1f6ef162f2
-
SHA1
be07eb64d13bd9b8be47210fec3361f5722bf13c
-
SHA256
7a3367528cbebf26612a7b3c6db5e73ecc437b0f41564581eb6d35f739c10bc4
-
SHA512
13c46b5996f3404a350cbea86d4258e3eb2970b344ba6f19e280fd2ae2c2613b66aba57c682072b34c40f102db2bac0bf80c60cc78699c4bb4ace0debcd1c2e4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 1148 wrote to memory of 644 1148 cmd.exe rundll32.exe PID 1148 wrote to memory of 644 1148 cmd.exe rundll32.exe PID 1148 wrote to memory of 644 1148 cmd.exe rundll32.exe