Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 07:44
Behavioral task
behavioral1
Sample
96a57994dac844201da03003ee2183ae.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
96a57994dac844201da03003ee2183ae.exe
Resource
win10v2004-20231215-en
General
-
Target
96a57994dac844201da03003ee2183ae.exe
-
Size
11.9MB
-
MD5
96a57994dac844201da03003ee2183ae
-
SHA1
e7cd1448b9b33c928b25451a9f72de71b2dbc7bf
-
SHA256
9353cf6347377bf1194349bff4001485fac99a5cd3ee03781e81c157452dae68
-
SHA512
5f82aa92a1f15287884bc7fcb26f7b0bcf2db0444417c678e613c46f0c9da0833845ca1fefc10ea35ec58ad6d7c9c627081bdf94915e41f136b6abdf3e6cf6de
-
SSDEEP
196608:wnHdJmVsyb49UuImXz1neX38DXDQ9/tbYPvbJQlHPrO2SvMTvN8CTJ+iGydotQa1:wnHdJmVsU4izm10MDTQ9/kJQlvrJTLxG
Malware Config
Signatures
-
DemonWare
Ransomware first seen in mid-2020.
-
Loads dropped DLL 56 IoCs
pid Process 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe 1992 96a57994dac844201da03003ee2183ae.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1992 1656 96a57994dac844201da03003ee2183ae.exe 28 PID 1656 wrote to memory of 1992 1656 96a57994dac844201da03003ee2183ae.exe 28 PID 1656 wrote to memory of 1992 1656 96a57994dac844201da03003ee2183ae.exe 28 PID 1656 wrote to memory of 1992 1656 96a57994dac844201da03003ee2183ae.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\96a57994dac844201da03003ee2183ae.exe"C:\Users\Admin\AppData\Local\Temp\96a57994dac844201da03003ee2183ae.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\96a57994dac844201da03003ee2183ae.exe"C:\Users\Admin\AppData\Local\Temp\96a57994dac844201da03003ee2183ae.exe"2⤵
- Loads dropped DLL
PID:1992
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5114afee6280e95bc6c41a29a96a9af38
SHA1d291c7ebb76379fa27d50247c99930d7008098e7
SHA2564574a908b73eacd5e00a00e6ebe5c040372cddbd583fa5b2ff8f7cfa03970c3e
SHA512976782f6419e542aa5b4cabe300029a47a5fb4d2699b2e94a1f12ab846c1c19e8df3414abc13d613eac697ad94f67b5338293204cc574c979de098c125880b84
-
Filesize
81KB
MD54c360f78de1f5baaa5f110e65fac94b4
SHA120a2e66fd577293b33ba1c9d01ef04582deaf3a5
SHA256ad1b0992b890bfe88ef52d0a830873acc0aecc9bd6e4fc22397dbccf4d2b4e37
SHA512c6bba093d2e83b178a783d1ddfd1530c3adcb623d299d56db1b94ed34c0447e88930200bf45e5fb961f8fd7ad691310b586a7d754d7a6d7d27d58b74986a4db8
-
Filesize
76KB
MD50f75c236c4ccfea1b16f132f6c139236
SHA1710bb157b01cafe8607400773b3940674506013b
SHA2565dc26dcbf58cc7f5bfdec0badd5240d6724db3e34010aaf35a31876fe4057158
SHA5125849ea147ada06c8b7a9fd523917009c173ace07ba1dbd320d7dda7f6d910b75ba4b7372f22bb56101c9dd836ce1a590b7715a7f34a67a489d70439b88998dd9
-
Filesize
113KB
MD53a2e78784b929003a6baceebdb0efa4d
SHA1abb48b6a96e22b9bd6d2a8443f5811088c540922
SHA256f205948b01b29cb244ae09c5b57fd4b6c8f356dfcd2f8cb49e7cfd177a748cf9
SHA512ad5a9a5143b7e452d92cc7ea5db12967b2073b626be3437d17041d7ae6d82ee24b15d161d2f708639d3bbf8c657202cd845009a219657557203497ea355876ce
-
Filesize
37KB
MD505362add80824b06014645a7951337d8
SHA176699e6dae7df93626906e488ef6218f9afcf8b5
SHA25620b3a3d3350b3d4d57911ecfdb15f77512a6e73c3bf72b410724f81c79a5b1af
SHA512061562b46e38c9bb83d49a9983d9848669ce2a20970451157b6474ef5dcc4ff38cc2a837b03cff89eacb4eae2063d2c1f43fccd6bd481dbbcabc5527f8489f0f
-
Filesize
182KB
MD554f12e2385a77d825ae4d41a4ac515fe
SHA15ba526ac1c5f16fb7db225a4876996ab01ee979f
SHA25608de18fba635822f3bb89c9429f175e3680b7261546430ba9e2ed09bb31f5218
SHA512ea88774fd63a3d806f96e99255705ac68f615508c5887ae18b8d488bdf87268a634c12eb167c13199f4a0fb31795531b1f7d48bdacbd46cf8affa694a630d259
-
Filesize
67KB
MD5cea329ce0935e99a8bc01070f07fefaf
SHA19d81307e9559d0661633530e5756957b05d84268
SHA256d1a4d66c557c2fe7dc441614ca62e67f37ec44bef5a762bac41bac15d491a930
SHA512b6aea9c2221bf35b0895c35942cf3c9613ec7919540b4c24a3b97d7a0846256e9ba654e8f233fadca1b15ff0b7d30d73adfaec85bcadb6100fd73e62d3a068ab
-
Filesize
4KB
MD5310b8716324d4f5519c1d5126bf12ba9
SHA16959d40c18b2d554c4d3920118451ba5489c9074
SHA256be3b6624b58958297e2216726a45a6e9cb3512a21764ab562fce485539b976b1
SHA51287be78808c20d4784d70d4a23944761fe087278bec1fefd21f313ce2fa743fca82ac6c7899d4ab30b81f1e98582555d7ea4a123e65a66bd9ab8bc0b95958e71a
-
Filesize
2KB
MD518ee65c73fcfa988e862b063a0b4c856
SHA18502c29b6c9cd0ae3a92958c6b02c73146b8a007
SHA2563eed4000473124a2fc03caca9e9dd9eb6360122cb25164a581287d85d4de07c6
SHA512c41ff3ca2cc0cc98ce467c44a5659ba12ae258f12f3541fe2fccd6bedbf22eeae2b79f0aeef3cad7105481d367e778950d00a688dc48b7fdc213903608bf0c1f
-
Filesize
2KB
MD5bfe4547efac2452f176205f1061ab7f1
SHA1b44aa29191f3e28048b78f4042d415663df206db
SHA25658cf9f30d2f12a465390edcd8d362ac87ca15ff6afcf8aff77c73bdf6b072bb2
SHA512b29f2875bb434289a212f1405cb4bdbb5102b7923a18dce25307ed97a59e6f5a086a8188c4a9a54a00db8874f522917d75aea33e1088ddbbec85e95703447e88
-
Filesize
4KB
MD5db0ef1cd436b49014e24ec6e5236c776
SHA143a97b964256dfbc1f2af5dd3e547c9482294037
SHA256ed375955427dad219b11564dea6922e10deebb83e8737eddf4aa574fe82b7703
SHA512d4f0811752e117b9ac24ef40b483db037d833d67e533f39258cf5ece0d0cd0e095b5a8010d391b3408c347afe8bdb9cde5098de8439dab96bbf1dc104834cc20
-
Filesize
3KB
MD51831614fb8dc580e147b5f00eb87eb8f
SHA1f6471a44998676d640fc46ca6796a23ae24302bd
SHA25677866a8a656f218d53ac848e34f982c83b1831556531e6bde4454772588fc34e
SHA512a2a1c5ec80cb12f056ac24c5940f1be41dc85f9ff81ad2a090c7b8aafa2449f53ee7ee6cf22ac4a020b89f6fd97a89d8a2643360ef5bec9e5e5e82ee1a63504c
-
Filesize
12KB
MD58e534f49c77d787db69babff931a497a
SHA1709380f53f4bee25ad110869ac4e755391346405
SHA2565b679b8119bb5d53107c40c63df667baef62de75418c3e6b540fdbafcceddca6
SHA51249e293828c96f159e2311b231e13d7292b9397aa62586bd0289c713e541d9014d347cde07c8529df3402c40e8fe8a96ab72efcce9f731ba95eb416506efcdcea
-
Filesize
15KB
MD533e8ccbe05123c8146cd16293b688417
SHA1d73246eb64af4f7ded63fb458c6e09c7d500f542
SHA2569ce840d9a67c4700d271f27a8e5163eda506ce46c85b501687955b55fcb3d136
SHA5125468adb8e76aced26f1f33fd0cdc72d194f92b1cbdf3f8169bc12e0eec1593f568c18d0e937898ccc3463003f939181131e41c6d5928bf393ded09c95f63e705
-
Filesize
11KB
MD585ceba9a21ce5d51b35ef2de9ebfbac4
SHA12d695a3e2257916f252d746c5cc0b48ac2ba1380
SHA25669e2e6459ea24237d5fcfc429acbc80bbb5852044a1b79f0aa6b544c4f770d95
SHA5125d2d7e9079f53efa667f29529ce9c9c10af8d7ef541b62e2934c6b68a0a16cbfec57e49297091a99c9db3bd0674f3173036e018f6559be5d6bac554d1da8f29a
-
Filesize
13KB
MD573ced8b30963e54d262dae2559116e46
SHA1090e42c4b7f736e69c248ad6b790bb68b5bee9ee
SHA2568b018f12e560d1179f1ad72811dbf7c60743061bedfa332a6562cf3db5cb413f
SHA512b7c0514c14ff82efbdc69ad42a3fef0a9aa1ba5112e98f7911cc6abec238980ac1104d467278608fea65f5674b6097cdccf17698c076ee14cc5d963819877ec3
-
Filesize
12KB
MD54669249fb01ea369c7fd40a530966fa1
SHA1106454588625bcf1a86db25333bb519e7f09ee61
SHA256bac9384ba44857279ac04865686941243ea4fac9c08c3d29feb1b53d92e76edf
SHA5122036043c318d164d6701c022c7bb7569051a8fe8e87518a62fc4259fcabee3da481197a375c607ee1505ff66467dc019e1fb4a9db0087c3b0e064c1d4ef864c2
-
Filesize
11KB
MD5b23936cf83dac4b64660a88711b5234a
SHA161431cfb47f8d36e67d2a046db318015af4d3107
SHA2563927a4b0b4591989f8c7b25e747286b359618b4de6f7680b2230c1cfb0d12782
SHA512f9c4cdda309b64a51cc4ddf0d033d2c20ec11a92b8cf46c190d1f341434f28bf683960e5ad7d06ba20776bb95f5d9725155864efe20fcb2775cf4ed2d1568b41
-
Filesize
21KB
MD5c1096da4634ad3356a10c00b24f53393
SHA16ea87bf1a88e57954f1c34047423bc342cd407ca
SHA256a2dbfc1a5baa66e257a4acc63289fa73adba893f837e2b304097ab829bab257a
SHA512d0ed94cb0b7746c324067d9485620d8693140c04c110482d685560e21c730e840056c87dadf58239f6a9f3e28cd650b0b8ecac011e03b6d6b57adc76213f0427
-
Filesize
12KB
MD500a0a24bb2e9aade11494b627eb164c4
SHA198c1121324f8e8aaa64c673d79315cc27fa0d25c
SHA25658dcf9ec3d0747a4ec23c7a1ccdb8eb0a6ad3aaebb0d8c0dd480922d012c8ecd
SHA512c8574f04172aed489b8ee91e0189314ca6b66d0d8b99275968ec888ee5c13f5f7b6d211064620b62fa1bfb6b54d7fd832823cf582e7949a07d5ecc45275b4f79
-
Filesize
15KB
MD5408019e57d3d2da62a9f28389eed0ac1
SHA1e48d1166a8fb95da90787d820ae7cae859bc626a
SHA256096139cdeaa408c3e3bd393a7188cbd6c296c3fe4e4cc15da113286a3f713dbd
SHA512fc18b2b1aedd2611ce78e92c4b283f519b5b25ebb0be5fe618a4fdbdf60c68f1edb486b74e59990e04f6b2606a9681edd433a32e6f9dc10ffe043d8dcc64eb03
-
Filesize
17KB
MD59d66fcc681389ec619d4e801f1ddbb2f
SHA1605385439a2b9295efff604f27849778696befaf
SHA25651c54ebaec17c1216e0fcd926a2dc8a377cf278127e4fbf6cd26e0fda51c23e1
SHA5120776dbc733491502c84c4eb3d532b52acea0f08258647d488ffb68df2997ef4cd750b2667f94069991ac7c4001be681cd525e56af51bf1f43dda4f095f6daa00
-
Filesize
17KB
MD56c7f782fdbf9aeffe7663fa1579a610e
SHA1d1504bf86117cd552bc1b97a49745780d35007bc
SHA256083b8b0e45864b12c60417dd3c5fe88b68ffc45a245d50df84f2a55b1dfcab38
SHA512d293ed48b09a0ad5e6b3bd0ba45feac092fc4c06dcb06eb661b6df7a061e402148a31b45b2074be97b4bd6ee7daf92f60cc17e1bd4d655f4b1cbc0bf7b3c8974
-
Filesize
13KB
MD539f9d0f1b698d53d78c79576c7c60526
SHA1a2015e56318b650de7436231db6a09ab95f001db
SHA2567a69214583d61cca3b8d765b488d6da070fccdcc02b76ee4c66aeb809f88c1da
SHA512262fd3231c73f35deaebcb5953ebe3a639d8e4461a58d546ee962f5f1e254cb40eaad235ed4c2da780b737158ba82bf7c029e35007183a7891bea307edd922b7
-
Filesize
758KB
MD58efce26de79adc41e5a561c9bd57d55a
SHA13bc5ca5d0beebbf2ab3966786201e6091e749021
SHA25643acaf29b6ef212ef07fba3a6f741372e418b718188cc53b5c6bbfdb45f411af
SHA512800fd4fd0c8f5f0c1cbe7d776669d8a364ffb3a5cca6ba2fc5f7e5adc791b970791a9eea28a14ae871fc20707015a4ff680ef066d1eea9c74795a46bcd61cc70
-
Filesize
2.1MB
MD573def838c090acd4be070c649cbd3bf1
SHA13dd16cf7740119e7a1d4f56b4c4934a724682e84
SHA25652d89fac9e42d87300e1427cb41c331f78a7e488d0cbbed8db4adf9d930c89d1
SHA5121a1e799cce4986059b53856761810f63829cbc5ead197032ce02e9d3905804d34c8d4d8fcf8a0fe5ac9e5f2f30883f7d4181d0551d4195c2356baf3ff5bd0da8
-
Filesize
28KB
MD5bc20614744ebf4c2b8acd28d1fe54174
SHA1665c0acc404e13a69800fae94efd69a41bdda901
SHA2560c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
SHA5120c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b
-
Filesize
165KB
MD5e8da8cabc1dd0d5b66f575236e0225e2
SHA1f0d06fdc3620696ee98e2f0e6da8594b6bcfd878
SHA25679a0e4e86126af297594c76f4d855e36070fad50b62e62f569a45114ef5432fe
SHA51269ba16197508de74e943cad146eee3cae38bdb30016d9d431bfe19274dbb4296aadd9db97fe9b9b11a0e5feff24885e54c4d73b9a2641286afe984717a57b8f3
-
Filesize
3.9MB
MD57e771d92e814a9fe3520b9f1af6176e0
SHA12b1d2fc31fdc2d1940d3835e1e62214414e6cffd
SHA25654326ecd163c7fffcdd02620490b6bde727c6a3153bff9706cf086510e4aa36d
SHA512547bdf9048d3b3bc88741ce2307ed4a48b10407d17dbb9f5ba5a727d59d208069abddb90d24b3d4bf0aa5ced2bdcabec3230baf73f2576652035afe5a1297667
-
Filesize
23KB
MD526bc7e9826bc13a4d0cf681b0e5cf3c8
SHA1effff42e88cdd66bc4397de1a6d3b5ae540f820b
SHA2568e7366cf6e128f977f8977a8db45a714ba72e643b31bd26b7676f33d3d8df612
SHA51216d92785a234e60301aa6c4c5d508bdaff805689d4f160ab3c0c4d0c2376dd3616f676ad2fa81c08ea80e4fb862c3a15e1b59212508dddb388c8a768726b018a
-
Filesize
320KB
MD5e2d23894f0cc3a8cd1b4fb5d163f8c67
SHA108da4d50c7d97330084ac3a5fe95d1755af40ded
SHA2564345b70ad39aece7eade6cbd54fe26b5a4b335dc26fd4a9032d44710b4f87f1e
SHA5120003e03a5ff1cec6f9975aafd2462dbb45cad5d0d55be6035dff359103ab8e79599ae901c05115cfebad3c124a14b68c01c5f49e865922e9a78bf1737e25345d
-
Filesize
177B
MD58b1fe07f490973f8a3b4148e5a70ce9c
SHA1b0fdf413ccbd6b7dce6ad07c0a087256c70fa24b
SHA2560d8a85a8096df1504231146cf7c76d122d3e90e7b4c489a17327921e6e36ba05
SHA5125eb8204ce5b8f46f96532a07526b25f89a2993db9017df23fd78947a8a748b571ce609dce274cd4b057c13d9fdd840d36f3c146a746bc5b7e6abd23ba4a9e917
-
Filesize
174KB
MD529928f61aac2e9989bb097620b52a289
SHA1b4155500d043a74af91dcd2e6c0084085cc01288
SHA256eb8de455ae9ef9b5223da2eaa2a74121eb2fe5371cb07e803e8e6e5c3cb5fb44
SHA51241cac99640154ca9661b01e267c4bde328223d8281f4be7f4ce48876340e54dd89d1690c231b366d1161d029390b130b08e6bd2da1b0ef4c214153e34d53e7f0
-
Filesize
4KB
MD5c5ea7fe690b2a95e94db00c58e28cd56
SHA1b921ed71658596d9a0fe9fcfe82d8268fa609dde
SHA256fe03d3d6b7a48de6338629b8c8a238fd7d31e537d60f2faaaeb6d1dd7a947537
SHA512286b4458e809b66d8b36a38878013b50d5b7ca8df467ea02337883fded012ea703de7288cfcbd2f68478688c66d953e9d675b3bb07d884d1e7cb5bc8a5cf8e47
-
Filesize
11KB
MD59f9fe5f52e9b2ad655c896b849883b1a
SHA1fd1119dbd0c38e7fc075be6a9d0efe4789f78387
SHA25644d5822d611fe29cb8530fe4bb86eaa8f9f2e135504e2304f8ab4ad6e37b8d36
SHA5127970b3ef135423602234737da54ba6b248b670a818616f501db6e64455c7a89fdc023ddd711c6a45a7cfc25a715fa8a9c608013bca2a724f5d605b95f32830d7
-
Filesize
1.7MB
MD5c7d1bfd81417c9cc9e2c291a8ed7800c
SHA13170c27b5afb43731766087631c8ad8c3095b4e0
SHA256314482d683014bf4f2e23a2fc3d0bbeaac40b8b7f02b1d37ae701dfed8ec1ab8
SHA512d4f00497eb6695bb2c907ace1c3f4608a08974dcfb6c5f1d8e034be9d8c6f335a1a79fd33f821f9d80f439a664e655f4351db57ac18c8e9aed03e4e766171ef6
-
Filesize
512KB
MD54c588f2864b3173f39a6287b154fa694
SHA1d215c160d58649ff0af7673645945bbfb610e2d2
SHA256e4a95cf320c3a83a73436224ab2c0428791b7878a1739fa38400ce56597fb494
SHA512e32e63c3dbbd0653908aabf23cf21ba704a22924f106d5c81c082948f2f0bd69067f01940aa5b18b471744d444aa5ac618e521d2b83519ce6865313789157cdb