Overview

overview

8

Static

static

1

6f084bfc9e...af.exe

windows7-x64

8

6f084bfc9e...af.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 01:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe

  • Size

    1.9MB

  • MD5

    dd56ec4f23743414581e3e3b8bff5efa

  • SHA1

    9852e771cc191380a02e65b3efa5ed2d0aa09c87

  • SHA256

    6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af

  • SHA512

    6c8f9f519a30ccf98f64967bf8e3c922fcf54a2d1f584b501907c0353e3cd1391253472b39b344948e61c7185bd793a145c034d71ecdb09e2668ca85a355a0e0

  • SSDEEP

    49152:MUOD1KJg/zjrYNjlCnhSYgZE8Xsh050F3Vsb5EX1QxoYiXYiOmPy:MUODawfYoYf

Score
8/10
persistence

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
    "C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
      C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
      2⤵
      • Drops file in Drivers directory
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\System32\Notepad.exe
        Notepad.exe C:\Users\Admin\Desktop\Rkill.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:2020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
    Filesize

    581KB

    MD5

    aa06c32c46fa65dcb7ab284f4364dcec

    SHA1

    e20a450dc827123a8e6de6c54229fe54668deaeb

    SHA256

    4b8ccdb9de55e61bf8d27143e8362bd9b2fb1ea9b734b9372bc5424febbba9c4

    SHA512

    66beba51426400c7cce93c3c09fad7347896336dd120f890a815309434b6cf25d8a0413851e8c4f95ecaf3991591a421c334445d82dc10ee56927fbfc5fe24e1

    Download Submit

  • C:\Users\Admin\Desktop\Rkill.txt
    Filesize

    4KB

    MD5

    783f13aaef6b8ee61f99ceadabaf225f

    SHA1

    3a841c26bc068183e81c408caf957dc31ea83038

    SHA256

    16ea3fb6a06e1c89ea34715c156f7b293a9ec9fa57d53bf61b7521f4f8e4d4d0

    SHA512

    440b4abf006e972f17a253df4abd0e4fc62a54584a69ecceb9d2dc44471f5bf03ed1919e435121cf00557a303f7c84a9d015877186ea5ba28d56f46f933c2f18

    Download Submit

  • C:\Users\Admin\Desktop\Rkill.txt
    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    Download Submit

  • \Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exe
    Filesize

    1.1MB

    MD5

    48fc85cba4a27dddb52283ca94db3d61

    SHA1

    275513b755211b9d7fdba817e53be73ec89934bb

    SHA256

    2546a59e3cf17e474a639b015eecac8ffcac037fada4c04a1bb0524380ee2e9d

    SHA512

    3dc10ed6162e3b81e3746fc7bf578c5825206c0e5b7d5c9dff3646c626c0891f09cbc37d4c9a52fd0ae8522e1bf8868f6d0eaa8ae1debe1d0d336a30589f452c

    Download Submit