Analysis
- max time kernel
150s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
17/04/2023, 20:25
Behavioral task
behavioral1
Sample
sFX.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
sFX.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target sFX.exe
- Size 294KB
- Sample230417-y698jsfh94
- SHA256 8a186f546c36a34567b695addfb776f2c2df584535a133fdf3ca699d4ec64e38
- MD5 55536247ecd1a051a72d5985c97425f3
- SHA1 3a97479623694ba395b86cc64b7e18cc86b39e24
- SHA512 d2e6d6a024edd785a92fb27abf1b90619edc98f88e045b242796932f8c4f0c1dd96d5f0e91d0fa5072a1f68c836d8d4893bc3bc2943e4880e62a70ce23276696
- SSDEEP 6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIm:v6Wq4aaE6KwyF5L0Y2D1PqLg
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4156-133-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/4156-134-0x0000000000400000-0x00000000004C2000-memory.dmp upx - AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4156-133-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/4156-134-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe 4156 sFX.exe