913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2023 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
Size

4.7MB
MD5

bacaa058bef5c78a0029a9f62b2f0ecc
SHA1

fc69f2354d21555cf7161346b7673a6885beaced
SHA256

913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac
SHA512

5451b9e5db17c73149e9cc9677ac20f815c64a56cc22de1886fd1129cb0b7b73b5aba1aca674daeb681a5f4c6736a23303df616fe74ab8e7d7770570139d53a0
SSDEEP

98304:h6LMHTB8e8AMPwttRNUVMOfXQlBH4cyfiG8kbIohr:h9z8AMPwAG2qkT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe

pid process

1940 913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe

pid	process
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
1940	913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe

C:\Users\Admin\AppData\Local\Temp\913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe
"C:\Users\Admin\AppData\Local\Temp\913c41b495f5180383aa3d441e0f8f263c9d04b231443cbd1bc3d59521179dac.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-133-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-134-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-135-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-136-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-137-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-138-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-139-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-140-0x0000000001980000-0x0000000001981000-memory.dmp

Filesize
4KB

Download
memory/1940-141-0x0000000005D90000-0x0000000005D91000-memory.dmp

Filesize
4KB

Download
memory/1940-142-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-143-0x0000000001980000-0x0000000001981000-memory.dmp

Filesize
4KB

Download
memory/1940-144-0x0000000005D90000-0x0000000005D91000-memory.dmp

Filesize
4KB

Download
memory/1940-145-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-146-0x00000000034E0000-0x00000000034E1000-memory.dmp

Filesize
4KB

Download
memory/1940-147-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download
memory/1940-150-0x0000000000400000-0x000000000165C000-memory.dmp

Filesize
18.4MB

Download