Overview

overview

4

Static

static

3

ModAssistant.exe

windows7-x64

ModAssistant.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    110s
  • max time network
    111s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20/02/2024, 09:10

Sharing

Copy URL Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    ModAssistant.exe

  • Size

    983KB

  • MD5

    5012dac274c8eaffe841ae904267b67b

  • SHA1

    0d7f4d9ef1a9e76a222d355b44b8fb88f3a062ef

  • SHA256

    fb26a91bc5c1c194e3eb3c0f894ba5f4987c274ed39ddfc50339f7167ff588be

  • SHA512

    ecaa5da85f6c8ee62d13e1a0b414d31983694029a053799b43daed1bf8e3a99a9834621ee8f2198abaf7001e957e68ceaba8e3bd5805f06d11bc8a4cc28f31b2

  • SSDEEP

    12288:NdzGb7XTKA40OCMjHO8o1lmR2oT53dKrtxeCfgFb7jteYx3QI6x0u+Ac/Krtj:N8PtZ6ESCmb7A2U03Ac/E

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 55 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ModAssistant.exe
    "C:\Users\Admin\AppData\Local\Temp\ModAssistant.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1064
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2896
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\death.txt
      1⤵
      • Modifies registry class
      • Opens file in notepad (likely ransom note)
      • Suspicious use of SetWindowsHookEx
      PID:1664
    • C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\Downloads\death.bat" "
      1⤵
      • Drops file in Program Files directory
      PID:1564
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\death.bat"
      1⤵
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2248
      • C:\Windows\system32\shutdown.exe
        shutdown -r -f -t 00
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2164
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x0
      1⤵
        PID:2196
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x1
        1⤵
          PID:1512

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\ModAssistant\ModAssistant.exe_Url_uvya445esj3mrh2ykgtad0kb3wn4bbm2\1.1.32.0\user.config
                Filesize

                824B

                MD5

                048bc90c075025e4285c45b9924d3f7d

                SHA1

                59e883fb2524f9924bda29e35d976d9c4648e178

                SHA256

                5a16f6669cd8b3c1dc42b002390d794638c426b3687ea9041288131217a1ecde

                SHA512

                fc0d4dad073118eef4de356de1f0fb4e6d280f2f831a77e8a9d208c38e38379496f3278ee425fa9988f85a6a0271a17723684d062ed3004c3ad1e22128fe2b44

                Download Submit

              • C:\Users\Admin\AppData\Local\ModAssistant\ModAssistant.exe_Url_uvya445esj3mrh2ykgtad0kb3wn4bbm2\1.1.32.0\user.config
                Filesize

                947B

                MD5

                bd49cb287c04dedde16dfb4573977f04

                SHA1

                c64c52e6a52a9d205b46ef870055ae0fade5de2e

                SHA256

                da0ef62bf5fec5c1071c552baa89b6fa11dee5934f150bef86a8cfba4b8d9271

                SHA512

                091bbd0e55a20f38cbafcfa877c4a5bcdfde4bc1c525688040da91084404ed752ba7a759962f48b2f8ee425374961c17c956f3f261d6a6e0bedd79cb9f7b0544

                Download Submit

              • C:\Users\Admin\Downloads\death.bat
                Filesize

                60B

                MD5

                80dd05fc5ea9323cf9618ca70828f659

                SHA1

                3e8ba78abb9e70868e46cd9ec38dbc8a6254912f

                SHA256

                24732accb7a1c4c97c53edc041cbdd3e7fb70a155994b4aa1cd670c20c91d062

                SHA512

                264eb61ee6ccec25c8381a660c7080ac09bba14b1b2793e65c646e3e11889cc27155c2d71fdf7414efaaa078e420721ce873c9c9bacbdd7041049b01610a0f56

                Download Submit

              • memory/1064-21-0x0000000074C50000-0x000000007533E000-memory.dmp

                Filesize

                6.9MB

                Download

              • memory/1064-24-0x0000000000A20000-0x0000000000A2A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1064-3-0x0000000000A20000-0x0000000000A2A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1064-8-0x0000000006790000-0x0000000006791000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1064-9-0x0000000006880000-0x0000000006882000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1064-4-0x0000000000A20000-0x0000000000A2A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1064-2-0x0000000004CF0000-0x0000000004D30000-memory.dmp

                Filesize

                256KB

                Download

              • memory/1064-0-0x00000000012B0000-0x00000000013AC000-memory.dmp

                Filesize

                1008KB

                Download

              • memory/1064-22-0x0000000004CF0000-0x0000000004D30000-memory.dmp

                Filesize

                256KB

                Download

              • memory/1064-5-0x0000000004CF0000-0x0000000004D30000-memory.dmp

                Filesize

                256KB

                Download

              • memory/1064-23-0x0000000000A20000-0x0000000000A2A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/1064-25-0x0000000004CF0000-0x0000000004D30000-memory.dmp

                Filesize

                256KB

                Download

              • memory/1064-26-0x0000000006790000-0x0000000006791000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1064-34-0x0000000074C50000-0x000000007533E000-memory.dmp

                Filesize

                6.9MB

                Download

              • memory/1064-1-0x0000000074C50000-0x000000007533E000-memory.dmp

                Filesize

                6.9MB

                Download

              • memory/1512-35-0x00000000026D0000-0x00000000026D1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1664-28-0x00000000036A0000-0x00000000036A1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1664-32-0x00000000036A0000-0x00000000036A1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1664-29-0x00000000036B0000-0x00000000036C0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2196-33-0x00000000029C0000-0x00000000029C1000-memory.dmp

                Filesize

                4KB

                Download