Overview

overview

5

Static

static

1

test.txt

windows7-x64

5

test.txt

windows10-1703-x64

1

test.txt

windows10-2004-x64

1

test.txt

windows11-21h2-x64

4

test.txt

android-10-x64

test.txt

android-11-x64

test.txt

android-13-x64

test.txt

android-9-x86

test.txt

macos-10.15-amd64

5

test.txt

debian-9-armhf

test.txt

debian-9-mips

test.txt

debian-9-mipsel

test.txt

ubuntu-18.04-amd64

Resubmissions

27/12/2023, 08:26

231227-kcc43afbcn 3

25/12/2023, 05:26

231225-f47qjagae7 8

25/12/2023, 05:23

231225-f3jmbaffh9 1

25/12/2023, 02:44

231225-c79shsdhb4 1

25/12/2023, 02:43

231225-c7yp9acegj 1

24/12/2023, 13:06

231224-qcfsvacaar 1

24/12/2023, 13:05

231224-qbs2sacaaq 1

24/12/2023, 09:20

231224-lap7aabehm 3

24/12/2023, 08:46

231224-kprg8adhc4 5

Analysis

  • max time kernel
    730s
  • max time network
    616s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 08:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test.txt

  • Size

    4B

  • MD5

    098f6bcd4621d373cade4e832627b4f6

  • SHA1

    a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

  • SHA256

    9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

  • SHA512

    ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\test.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:1212
  • C:\Windows\system32\msinfo32.exe
    "C:\Windows\system32\msinfo32.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    PID:2756
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:1544
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:1568
      • C:\Windows\system32\systempropertiesadvanced.exe
        "C:\Windows\system32\systempropertiesadvanced.exe"
        1⤵
          PID:1032
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
          1⤵
            PID:1132
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            1⤵
              PID:480
            • C:\Windows\system32\AUDIODG.EXE
              C:\Windows\system32\AUDIODG.EXE 0x7c
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2360
            • C:\Windows\system32\mmc.exe
              "C:\Windows\system32\mmc.exe" C:\Windows\system32\diskmgmt.msc
              1⤵
              • Drops file in System32 directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2836
            • C:\Windows\System32\vdsldr.exe
              C:\Windows\System32\vdsldr.exe -Embedding
              1⤵
                PID:932
              • C:\Windows\System32\vds.exe
                C:\Windows\System32\vds.exe
                1⤵
                  PID:2732

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/2836-1-0x0000000001F10000-0x0000000001F11000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2836-2-0x0000000001F10000-0x0000000001F11000-memory.dmp

                  Filesize

                  4KB

                  Download