Analysis
-
max time kernel
56s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
10/06/2023, 20:57
General
-
Target
xClientcrypt.exe
-
Size
1.6MB
-
MD5
2af36b688493efeccf83eb290ef85c13
-
SHA1
38e104c47b85e258f893e49d92221cc54a33d992
-
SHA256
b9bbb255f94436d22dbbcaa5a1493162e3bee1dd143109d2864136136cb30813
-
SHA512
d7e715fdd6d53cf1172c2479cac5ba9fde15ae573612c41fd49e2a08034e36ff18058c0d1f8c3322d903d74a84f5c3f4de876d52e8faa969ffae692c23c48885
-
SSDEEP
49152:rkQTA33tHV9yesrAWm77KrX9mnJijcZ2JbpQIu:ranlyes8WmuraijK2RpQIu
Score
7/10
Malware Config
Signatures
-
.NET Reactor proctector 33 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xClientcrypt.exe"C:\Users\Admin\AppData\Local\Temp\xClientcrypt.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\SearchWatch.txt1⤵
- Opens file in notepad (likely ransom note)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB