Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
20/09/2023, 00:42
General
-
Target
ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88.exe
-
Size
11.9MB
-
MD5
52960d978352d8fe776b97aa1651be33
-
SHA1
449352bc5b2056f94595e75cee9c4efc43a07e2d
-
SHA256
ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88
-
SHA512
03e9fb8af66935d6f8ce6174ebbe6354d0149adf397c480e3bb55b06f2a0d1c93c8adaaff98ccbef35a01b5997a774b42b418292e5074e54ee49c7698984005a
-
SSDEEP
196608:rxLTIlTXSLjcyyuMK5B+lGFb0hgIhDYmyArb7sG34KVtObfX8AZg76oLlrBt16AO:rxvaTSjauRgG1m7szAh3xVtObfsAS7By
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 13 IoCs
Detects executables packed with VMProtect commercial packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88.exe"C:\Users\Admin\AppData\Local\Temp\ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ÖðÈÕÀ×öª\ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88.exeC:\ÖðÈÕÀ×öª\ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11B
MD5c459d066cae28521f56d4818fd84de7e
SHA1988469e45106af18432bd62615f33f4635c5a2f2
SHA2562e5b064179076dcfb44af4be704df75dd21f37db039377ba72d6fccd724b0309
SHA5129d829b8f27f962b82961b3084caf0753bbea9de098b5d3cce4274102a793d83a57b08be6f59ed03dbfe9437449893c7e82e2038425bf00be159af8aa99d932ed
-
Filesize
11.9MB
MD552960d978352d8fe776b97aa1651be33
SHA1449352bc5b2056f94595e75cee9c4efc43a07e2d
SHA256ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88
SHA51203e9fb8af66935d6f8ce6174ebbe6354d0149adf397c480e3bb55b06f2a0d1c93c8adaaff98ccbef35a01b5997a774b42b418292e5074e54ee49c7698984005a
-
Filesize
11.9MB
MD552960d978352d8fe776b97aa1651be33
SHA1449352bc5b2056f94595e75cee9c4efc43a07e2d
SHA256ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88
SHA51203e9fb8af66935d6f8ce6174ebbe6354d0149adf397c480e3bb55b06f2a0d1c93c8adaaff98ccbef35a01b5997a774b42b418292e5074e54ee49c7698984005a
-
Filesize
11.9MB
MD552960d978352d8fe776b97aa1651be33
SHA1449352bc5b2056f94595e75cee9c4efc43a07e2d
SHA256ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88
SHA51203e9fb8af66935d6f8ce6174ebbe6354d0149adf397c480e3bb55b06f2a0d1c93c8adaaff98ccbef35a01b5997a774b42b418292e5074e54ee49c7698984005a
-
Filesize
11.9MB
MD552960d978352d8fe776b97aa1651be33
SHA1449352bc5b2056f94595e75cee9c4efc43a07e2d
SHA256ddf8c6f28f6feed0787ea40cf9683157f90f66d9639bc6d63bbf55bfc363cb88
SHA51203e9fb8af66935d6f8ce6174ebbe6354d0149adf397c480e3bb55b06f2a0d1c93c8adaaff98ccbef35a01b5997a774b42b418292e5074e54ee49c7698984005a
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.5MB
-
Filesize
4KB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
4KB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
64KB
-
Filesize
17.5MB
-
Filesize
17.5MB
-
Filesize
64KB