Analysis

  • max time kernel
    169s
  • max time network
    205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2023, 17:30

General

  • Target

    11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe

  • Size

    1.3MB

  • MD5

    df134a54ae5dca7963e49d97dd104660

  • SHA1

    9bddcce91756469051f2385ef36ba8171d99686d

  • SHA256

    11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394

  • SHA512

    9046be2d1af55141001c8f35b06af2607a329e3b4d97253972362ef4ffb61106be3bf6701cbcc36f1a39028c9f17d19b414f6ee63bc34e4622a5833752a17914

  • SSDEEP

    24576:fsspRa70Hm5QQF0fTOOqs60utA+islfs/DHEj3TBi0mhwLlz2Ya60xchhH2yP1DF:f7W707QEpq3u+PkDHEj3TBi0mhwLlz2q

Malware Config

Signatures

  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe
    "C:\Users\Admin\AppData\Local\Temp\11ddebd9b22a3a21be11908feda0ea1e1aa97bc67b2dfefe766fcea467367394.exe"
    1⤵
    • Modifies extensions of user files
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:212

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\Favorites\readme.pdf

            Filesize

            529KB

            MD5

            e7a1ded35fa8603ad2d8ea413ed70822

            SHA1

            8e51bc110584663dc297af70b76173b9a05bb39e

            SHA256

            c14c8e924987138d0ec9c1a99dd5ac728ce102aa5c6b13829ec8d21ddb243f28

            SHA512

            e1122f6bf05dc22ed840ace88a6c3823db98fb05362e5cac3202bd49951593e562d57e3fe7cf05a1dfcf6b34c2e594f999287fb8ed973a3b870cce2a4e9955b4

          • memory/1636-133-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB

          • memory/1636-134-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB

          • memory/1636-135-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB

          • memory/1636-207-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB

          • memory/1636-247-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB

          • memory/1636-310-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB

          • memory/1636-367-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB

          • memory/1636-392-0x00007FF792200000-0x00007FF79232F000-memory.dmp

            Filesize

            1.2MB