cf0ae2402477e9e23db7458beaf15860a12c15985be6edd9d2ac1d122550df09

Analysis

max time kernel
146s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
25/04/2023, 17:18

Target

notavirus.exe
Size

6.7MB
MD5

55389f6a2ee7745a4a3804dbc7098742
SHA1

722c7debe719ac3e850a5c587ce735a618f76c76
SHA256

cf0ae2402477e9e23db7458beaf15860a12c15985be6edd9d2ac1d122550df09
SHA512

e10b2bb787211394080417f9352fd229315cb7acbb5628e03345b9ebca9bcb20967a09dd74174a5306ea79fd2f2e64f9f705d3f405ff2b282e914a189358568c
SSDEEP

196608:IOv8Zk5dQmR8dA6ly8Qnf2ODjMnGydS8TtErDOSWZ3:zqk5dQJl6F3MnG38xErDns

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
576	notavirus.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
1112	NOTEPAD.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
576	notavirus.exe
1112	NOTEPAD.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 944 wrote to memory of 576	944	notavirus.exe	27
PID 944 wrote to memory of 576	944	notavirus.exe	27
PID 944 wrote to memory of 576	944	notavirus.exe	27

C:\Users\Admin\AppData\Local\Temp\notavirus.exe
"C:\Users\Admin\AppData\Local\Temp\notavirus.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:944
- C:\Users\Admin\AppData\Local\Temp\notavirus.exe
  "C:\Users\Admin\AppData\Local\Temp\notavirus.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  PID:576

C:\Users\Admin\AppData\Local\Temp\_MEI9442\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI9442\python311.dll

Filesize
5.5MB

MD5
9a24c8c35e4ac4b1597124c1dcbebe0f

SHA1
f59782a4923a30118b97e01a7f8db69b92d8382a

SHA256
a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7

SHA512
9d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b

Download Submit
memory/1588-86-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1588-85-0x000007FEF7260000-0x000007FEF72AC000-memory.dmp

Filesize
304KB

Download
memory/1588-87-0x0000000004750000-0x0000000004751000-memory.dmp

Filesize
4KB

Download
memory/1588-88-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1588-89-0x000007FEF7260000-0x000007FEF72AC000-memory.dmp

Filesize
304KB

Download