Analysis
-
max time kernel
39s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31/03/2023, 22:16
Static task
static1
windows7-x64
7 signatures
150 seconds
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
-
Size
14KB
-
MD5
19dbec50735b5f2a72d4199c4e184960
-
SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822
-
SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
-
SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
SSDEEP
192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 [email protected] -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2008 [email protected] Token: SeShutdownPrivilege 1984 [email protected] -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1960 [email protected] -
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2008 2032 [email protected] 26 PID 2032 wrote to memory of 2008 2032 [email protected] 26 PID 2032 wrote to memory of 2008 2032 [email protected] 26 PID 2032 wrote to memory of 2008 2032 [email protected] 26 PID 2032 wrote to memory of 1984 2032 [email protected] 27 PID 2032 wrote to memory of 1984 2032 [email protected] 27 PID 2032 wrote to memory of 1984 2032 [email protected] 27 PID 2032 wrote to memory of 1984 2032 [email protected] 27 PID 2032 wrote to memory of 1996 2032 [email protected] 28 PID 2032 wrote to memory of 1996 2032 [email protected] 28 PID 2032 wrote to memory of 1996 2032 [email protected] 28 PID 2032 wrote to memory of 1996 2032 [email protected] 28 PID 2032 wrote to memory of 1960 2032 [email protected] 29 PID 2032 wrote to memory of 1960 2032 [email protected] 29 PID 2032 wrote to memory of 1960 2032 [email protected] 29 PID 2032 wrote to memory of 1960 2032 [email protected] 29 PID 2032 wrote to memory of 1712 2032 [email protected] 30 PID 2032 wrote to memory of 1712 2032 [email protected] 30 PID 2032 wrote to memory of 1712 2032 [email protected] 30 PID 2032 wrote to memory of 1712 2032 [email protected] 30 PID 2032 wrote to memory of 756 2032 [email protected] 31 PID 2032 wrote to memory of 756 2032 [email protected] 31 PID 2032 wrote to memory of 756 2032 [email protected] 31 PID 2032 wrote to memory of 756 2032 [email protected] 31 PID 756 wrote to memory of 1760 756 [email protected] 32 PID 756 wrote to memory of 1760 756 [email protected] 32 PID 756 wrote to memory of 1760 756 [email protected] 32 PID 756 wrote to memory of 1760 756 [email protected] 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2032
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1984
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1996
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]" /main2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵PID:1760
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf