Analysis

  • max time kernel
    90s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2023, 05:00 UTC

General

  • Target

    IBRA_30-12-2022_Mina_2_V3.rar

  • Size

    348KB

  • MD5

    0cb91159d85168c0707818779fcddcbe

  • SHA1

    505ee1b2acbe01fac4b738c5fe5e11636bc9a44c

  • SHA256

    ce246655a1634245a92b0ba781ac4829471a12a0ae1065645d761d729deb5d6a

  • SHA512

    26c9605f2cb60204a977cfc67a8f075e05141a1ff4753b84b662bd675d04a4fed70498c93f587a644426ab141424353eca7419327572681e7f3aeca077cd9dd3

  • SSDEEP

    6144:tooPRtcvwWejV+v9g+ZdPBu/LrZ30hzAa08mj2crG8oO75swQ7334EWf:eomKOBAczAa0Zj2crG8oM+b731Wf

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\IBRA_30-12-2022_Mina_2_V3.rar
    1⤵
    • Modifies registry class
    PID:2400
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1868

Network

    No results found
  • 93.184.221.240:80
    322 B
    7
  • 52.182.143.208:443
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 93.184.221.240:80
    322 B
    7
  • 104.80.225.205:443
    322 B
    7
No results found

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.