Analysis
-
max time kernel
91s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/01/2023, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
General
-
Target
665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe
-
Size
28KB
-
MD5
c3aa5efc9a1f5cba6f031b8a7be3584e
-
SHA1
6af4f9b81a3e80c910b85bdc22d53dfbc3d706e6
-
SHA256
665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93
-
SHA512
aeac12332a9d7de3eccd5b0b9753e243a595e89c147bbd5d931dba63a42aa700908aa5662ab167da5cef3da8ad46abc11a9623b25e68f8632de568c32fdb68b5
-
SSDEEP
768:0jxXngTpt72I9bFY4GqsWz3HsUnS3rjn:0mc+bFY4/fTMUQrjn
Score
8/10
Malware Config
Signatures
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\ExportSuspend.png => C:\Users\Admin\Pictures\ExportSuspend.png.proced 665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe File renamed C:\Users\Admin\Pictures\FormatUnlock.png => C:\Users\Admin\Pictures\FormatUnlock.png.proced 665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1252 665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 584 taskmgr.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1252 665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1252 665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe Token: SeDebugPrivilege 584 taskmgr.exe Token: 33 1636 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1636 AUDIODG.EXE Token: 33 1636 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1636 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe 584 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe"C:\Users\Admin\AppData\Local\Temp\665d7e656baecc8acccebf4b956719eb6c4099886f75008c8806efb945207e93.exe"1⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:584
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0xc81⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636