Overview

overview

1

Static

static

1

123.txt

windows10-1703-x64

1

123.txt

windows10-2004-x64

1

Resubmissions

01/04/2023, 20:44

230401-zjkj2sea4y 1

Analysis

  • max time kernel
    244s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 20:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    123.txt

  • Size

    36KB

  • MD5

    8695c763da4bbdc1c9c5e316ba7aa8ad

  • SHA1

    2ad893f85877c39179810de03cbaf5c01db5c5cd

  • SHA256

    c799c4484fbbdf59852e184628c7fac35a7fb39a0b2a9ac8ba487b96a5bc3033

  • SHA512

    7f6ecf268c59a223363c31d184ce6c04f34de65ede78d20c012f1c9147b7bbcfc86ccbcd9228ffe54705f0bd3bc313f1d71e403c1892003abc10c4668c5bae8b

  • SSDEEP

    768:G8imtLyvHVTzsY0KXFQMaCrmowi3pKFqOZcnwKWViqSON0y56ljV0s3gKzA4gE3j:G8ztLyvHVTzsYdrrmo/YqOKTqzNJK3/j

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\123.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:4896
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3124
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:1764
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
        1⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:548

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\123.txt
              Filesize

              36KB

              MD5

              8695c763da4bbdc1c9c5e316ba7aa8ad

              SHA1

              2ad893f85877c39179810de03cbaf5c01db5c5cd

              SHA256

              c799c4484fbbdf59852e184628c7fac35a7fb39a0b2a9ac8ba487b96a5bc3033

              SHA512

              7f6ecf268c59a223363c31d184ce6c04f34de65ede78d20c012f1c9147b7bbcfc86ccbcd9228ffe54705f0bd3bc313f1d71e403c1892003abc10c4668c5bae8b

              Download Submit