Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21-07-2023 20:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
gora (2).exe
Resource
win7-20230712-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
gora (2).exe
Resource
win10v2004-20230703-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
gora (2).exe
-
Size
12.6MB
-
MD5
0846ec9f85b4db6d3d7255be75d569db
-
SHA1
317396afd238bfd72b04a9e20b7de9cfc86d0719
-
SHA256
f164972422318d0385d832bb14e6e9f3aa1cf35deb4e3d9981cb31675a347322
-
SHA512
54e4c77e96ab49a1d62a825f900791551431a52a77a0f7d91a7e5c6e5a6821ea5e1ceddf0b6c025a64a3132bcd34c5335016ccda28f9d27d20eb3cdc30665439
-
SSDEEP
196608:eh1fzuraAnjocGL88gD8aD2mnWDNZ6pUk7ul9pt+lpUIvzifr:y62Anjo1dgvDLmWztLifr
Score
10/10
Malware Config
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2192 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2192 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe 2192 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\gora (2).exe"C:\Users\Admin\AppData\Local\Temp\gora (2).exe"1⤵PID:1784
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2192