Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31-12-2023 14:03
General
-
Target
3911d8371fd6fe478d4c2f7cbb85b170.exe
-
Size
109KB
-
MD5
3911d8371fd6fe478d4c2f7cbb85b170
-
SHA1
1ad4518dc51a50f64121cd96e040889824b8e42f
-
SHA256
1e9fbae11533c0c0a4b23bcc2cd310a5de0116c4515a44506b9c369a7d02a222
-
SHA512
391f0162c017ac3bf6bdc86504ad020957d03a6aa9f186737bd4a1c43027a87d83cfa66d1b7eaa1706760a9262b4f29760b159d9a8c3689dba99e532fe2fb444
-
SSDEEP
1536:+06F3hjSDjxe78yJZuP5+ILpBrv7Xv/+WS7lwS6arF5nfOHcGDW4l/rQqHs7:V6ie782ZIPLpBvXnV0lwormHcGK4+yW
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3911d8371fd6fe478d4c2f7cbb85b170.exe"C:\Users\Admin\AppData\Local\Temp\3911d8371fd6fe478d4c2f7cbb85b170.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\3911d8371fd6fe478d4c2f7cbb85b170.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD543fb2705d9766ea761f934981936503f
SHA1c9589c81355baab345cd121a76dcd743d65e131c
SHA256766a90366e6cac315d05afc9c97dcd6206a7f66da260dd41d209bb6ad13947e0
SHA512ebf82587e4a8dad580b0c6c6959c73315c584cea82c41c073aab41854a44027fbc63d3f360651e726bfe71bc9e99a1b803574715e63d462f90182291ce3dfbf4
-
Filesize
28KB
-
Filesize
512KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
512KB
-
Filesize
132KB
-
Filesize
128KB