Overview

overview

5

Static

static

1

test.txt

windows7-x64

5

test.txt

windows10-1703-x64

1

test.txt

windows10-2004-x64

1

test.txt

windows11-21h2-x64

4

test.txt

android-10-x64

test.txt

android-11-x64

test.txt

android-13-x64

test.txt

android-9-x86

test.txt

macos-10.15-amd64

5

test.txt

debian-9-armhf

test.txt

debian-9-mips

test.txt

debian-9-mipsel

test.txt

ubuntu-18.04-amd64

Resubmissions

27/12/2023, 08:26

231227-kcc43afbcn 3

25/12/2023, 05:26

231225-f47qjagae7 8

25/12/2023, 05:23

231225-f3jmbaffh9 1

25/12/2023, 02:44

231225-c79shsdhb4 1

25/12/2023, 02:43

231225-c7yp9acegj 1

24/12/2023, 13:06

231224-qcfsvacaar 1

24/12/2023, 13:05

231224-qbs2sacaaq 1

24/12/2023, 09:20

231224-lap7aabehm 3

24/12/2023, 08:46

231224-kprg8adhc4 5

Analysis

  • max time kernel
    1000s
  • max time network
    982s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 08:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test.txt

  • Size

    4B

  • MD5

    098f6bcd4621d373cade4e832627b4f6

  • SHA1

    a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

  • SHA256

    9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

  • SHA512

    ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\test.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:624
  • C:\Windows\system32\msinfo32.exe
    "C:\Windows\system32\msinfo32.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Enumerates system info in registry
    • Suspicious behavior: GetForegroundWindowSpam
    PID:3136
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3120
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:1456
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:3260

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads