Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    18/12/2022, 18:44

General

  • Target

    b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9.exe

  • Size

    1.4MB

  • MD5

    6d31f5e15aa86b05399c431a36cb5e81

  • SHA1

    e25bee0fe68dfb01ee5c9b0736095f8dcf2c48d2

  • SHA256

    b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9

  • SHA512

    86a421d1326717a45c90c666d2f6ead82fd16393eb40fce4bc88540bdb2b6d964c562ed125832d291b0157bc79556ec329f7e25abe1024b2651ee50d7a1032cb

  • SSDEEP

    24576:/GPmdY5IcNSaaaVfVxqo+MuWmQuAQRqUOgqRrN+tvNveCzDugwb:TSafCQRFq50vNeb

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9.exe
    "C:\Users\Admin\AppData\Local\Temp\b725707ffe49608f7e213e407f6c7c2c5bd9d5bf5ef258d25a0c34462f8c88b9.exe"
    1⤵
    • Drops file in Drivers directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c rd C:\Windows\system32\drivers\etc\Hosts.dll/s/q
      2⤵
        PID:1764
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c rd C:\Windows\system32\drivers\etc\Hosts/s/q
        2⤵
          PID:1212
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c rd .\Data\PY.dat/s/q
          2⤵
            PID:1508
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c rd .\Data\PercenarySystem.dll/s/q
            2⤵
              PID:1904
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c rd .\Data\TjBin.dll/s/q
              2⤵
                PID:584
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c rd .\Group.dat/s/q
                2⤵
                  PID:1808
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c rd .\Group.dat/s/q
                  2⤵
                    PID:1652
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c rd .\Data\popup.dat/s/q
                    2⤵
                      PID:1860
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c rd .\Data\Game.ini/s/q
                      2⤵
                        PID:1284

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/1520-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

                      Filesize

                      8KB