Analysis
-
max time kernel
779s -
max time network
683s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22/02/2024, 15:21
General
-
Target
ransom_builder.exe
-
Size
4.3MB
-
MD5
43a2c7ba0ecd3a1b8ff0b82a0e82296d
-
SHA1
9b106aa440085d1cf76889a186a4c0ece9f86b06
-
SHA256
bb623a98f1d61f13d2de4dee55b14f97956e8306aa66d945aab0b00538b95900
-
SHA512
2d1d9c37fcfc1f38e71a6f7be68431ec5e7220dd8eb8df6fa612be62bed071fdf1f505c9702d69719e74c99ae02af4a48909f63862addca7c4e911c1792b8f59
-
SSDEEP
98304:w8sjkaDkbFqE0DtuJFsEG/SxFEQGr7wgiMgaUP/XEXw5d1OFQ:yj3aqE0tubjTPgiFaUHEXgaF
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransom_builder.exe"C:\Users\Admin\AppData\Local\Temp\ransom_builder.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Include.exe"C:\Users\Admin\AppData\Local\Temp\Include.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD557945be40617051ea842b9a4dbcbdde9
SHA167b5944b4d52b81e84c97e4df6e47dc62365f98c
SHA256f263a9326c7d7ea9aea33d4dc6a19d362d0c69cef66b87a84b050141ef443047
SHA5120c063b4a1afdf625ed82389d2dfdcf52d6ca14febf659187294cfaf5fe4d49f74c5a6c8611b0f835997090b58b625071a76dc11a73172d074a5923114a6185a7
-
Filesize
10KB
MD522060345b3c4539ccd1905a1d81e7e2f
SHA180ba51f10245fa890e1cc4912852eab79302b23d
SHA256c7eefdfae421f6e0e54f56a8078d742272c9daf73ba43d2d82fc5db2366fbe81
SHA51267a0afe305986866773cbb39dbd26e0d8a57d9d8457e10423242a8d06fc20a281f98fce9a557e7d4c432661ef257e2b9782f9926eb99291d7875b68eeaebdd1b
-
Filesize
31KB
MD5332e16a4665067ab9583b57b9bd23da2
SHA1a786c06627ac32760904042c68584eced4cbc90d
SHA25699af0e549847b52f87814b286b903d25560e83b1dc76b0e9ea316c4af23d9fb4
SHA512bc12269c46936184288bfa901c9297494aa7635a6dd4739e6a9d567b5150358bbc0252510a5b208aad38ddb86e6e61a68114816f9ffca3735f79c4e190dd64f1
-
Filesize
156KB
MD519a588347de928200a06957f290b1b69
SHA1068e5813ffd54c37a352fa1dbca86bb114ccace6
SHA256d1e84a6b637ba81f38889a8feebc6ee6b6a656aead2b62b4853ff3a1917ab404
SHA512b33f363911c70d0315676ab031ab68272727b31ca01b3667ce7ac67fba676f0200691c7fe21df8058557f5c1183112218fdcbe7456a99afe4caead7fa7caa6e7
-
Filesize
40KB
MD560fe132dac8e3b5de8dcfd2d786ffed1
SHA19f90b0dc97522ec8bf725e768263bf8b2e14812e
SHA2564fc0b1c0a3aec101eff47a886d5280d23572aa3d9522f5aac5db8dd29c3b77f2
SHA512bd6b9cd6db6248342ef61955d548a583b6086be1705e920a83f4608eb7412215b84ea3277c01f8b0b453fae2e2bbb74eaa5e66117312747a0c5c9bc4eeb4043d
-
Filesize
54KB
MD5e8b0a2966dcec4c295bb24bfc267d4b1
SHA13236b20a29532af8f521c562457b5d7aec50e486
SHA2565f4bf03ce2e0867043da754c06c8b9ac47706553f0b350423fcf1c1aa3e488e3
SHA51240918c26694788c8790a76bd4378c6bfefa090731c2595700276076eae51d27b1908d02c5e93b2458ab5b4ef0731ce483d5619d29f61486fd42905a5c627636c
-
Filesize
102KB
MD55d7d068c1196651fc288d901d1068fec
SHA192eaada1ae48fb4f9117050e3eaa66b3c3b83a8b
SHA25600e7aa7ad31cc3e9b079476e70e1d599176c60a2995718691e9fca1ad9d9f10b
SHA512633a7f29cc6041fe613acd4148b7b201c2f3019f9ce9573a2388d61fd7e80ac34f5d106575092a09810e7c5bd1d55cfcee422c84e1e7be098050b311c7e5af36
-
Filesize
1.1MB
MD5719c51f5637d922e8416e23d0978b8cb
SHA1ebfc5fe2fcf48a36505716e997b1e2fab6365d85
SHA2566cf0bf46c9ee98fde7eb4dbc0b147e33babeabf9b1f50a4722e29dd57e95ef09
SHA512129a355ca1ace8c8ce7254c285d5e90b55941f18ff5fcaf6109aa502d18f543b7596493ce69c0bc167ce41bdc8622d4bf8529ecbd88fb0d9f963bfbcb91e24ae
-
Filesize
239KB
MD529e1d5770184bf45139084bced50d306
SHA176c953cd86b013c3113f8495b656bd721be55e76
SHA256794987c4069286f797631f936c73b925c663c42d552aeca821106dfc7c7ba307
SHA5127cb3d0788978b6dc5a78f65349366dac3e91b1557efa4f385984bef4940b3ea859f75cfe42c71f6fe445555138f44305531de6a89c5beff4bf9d42001b4348e8
-
Filesize
572KB
-
Filesize
1.6MB
-
Filesize
640KB
-
Filesize
348KB
-
Filesize
2.1MB
-
Filesize
12.3MB
-
Filesize
1.4MB
-
Filesize
572KB
-
Filesize
168KB
-
Filesize
324KB
-
Filesize
4.3MB
-
Filesize
640KB
-
Filesize
200KB
-
Filesize
36KB
-
Filesize
2.1MB
-
Filesize
348KB
-
Filesize
492KB
-
Filesize
1.6MB
-
Filesize
12.3MB
-
Filesize
1.4MB
-
Filesize
572KB
-
Filesize
816KB
-
Filesize
324KB
-
Filesize
628KB
-
Filesize
1.6MB
-
Filesize
640KB
-
Filesize
348KB
-
Filesize
492KB
-
Filesize
816KB
-
Filesize
200KB
-
Filesize
2.1MB
-
Filesize
324KB
-
Filesize
4.3MB
-
Filesize
628KB
-
Filesize
348KB
-
Filesize
2.1MB
-
Filesize
72KB
-
Filesize
640KB
-
Filesize
200KB
-
Filesize
36KB
-
Filesize
76KB
-
Filesize
324KB
-
Filesize
816KB
-
Filesize
72KB
-
Filesize
200KB
-
Filesize
4.3MB
-
Filesize
640KB
-
Filesize
628KB
-
Filesize
200KB
-
Filesize
36KB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
2.1MB
-
Filesize
324KB
-
Filesize
348KB
-
Filesize
4.3MB
-
Filesize
816KB
-
Filesize
1.6MB
-
Filesize
200KB
-
Filesize
76KB
-
Filesize
572KB
-
Filesize
492KB
-
Filesize
4.3MB
-
Filesize
748KB
-
Filesize
348KB
-
Filesize
964KB
-
Filesize
748KB
-
Filesize
964KB
