Overview

overview

10

Static

static

10

ransomware...om.exe

windows7-x64

10

ransomware...om.exe

windows10-2004-x64

10

ransomware...ab.exe

windows7-x64

10

ransomware...ab.exe

windows10-2004-x64

10

ransomware...ye.exe

windows7-x64

10

ransomware...ye.exe

windows10-2004-x64

10

ransomware...ni.exe

windows7-x64

10

ransomware...ni.exe

windows10-2004-x64

10

ransomware...pt.exe

windows7-x64

10

ransomware...pt.exe

windows10-2004-x64

4

ransomware...ya.exe

windows7-x64

7

ransomware...ya.exe

windows10-2004-x64

7

ransomware...en.exe

windows7-x64

8

ransomware...en.exe

windows10-2004-x64

8

ransomware...ky.exe

windows7-x64

1

ransomware...ky.exe

windows10-2004-x64

1

ransomware...ha.exe

windows7-x64

6

ransomware...ha.exe

windows10-2004-x64

6

ransomware...V2.exe

windows7-x64

6

ransomware...V2.exe

windows10-2004-x64

6

ransomware...om.exe

windows7-x64

10

ransomware...om.exe

windows10-2004-x64

10

ransomware...ya.exe

windows7-x64

10

ransomware...ya.exe

windows10-2004-x64

10

ransomware...d).exe

windows7-x64

6

ransomware...d).exe

windows10-2004-x64

6

ransomware...ap.exe

windows7-x64

1

ransomware...ap.exe

windows10-2004-x64

1

ransomware....A.exe

windows7-x64

6

ransomware....A.exe

windows10-2004-x64

6

ransomware...er.exe

windows7-x64

6

ransomware...er.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    0s
  • max time network
    1s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    15-03-2024 21:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ransomwares/JanusPetya/JanusPetya.exe

  • Size

    22KB

  • MD5

    d99988fafeda4bf3b6c509cf3e955b44

  • SHA1

    dc32834e410febfb32cba8e2e036e214a04b0172

  • SHA256

    68e126f148ef6f94e73222d8703d719d03558f1330711705b08b654eb95ca794

  • SHA512

    fd4bbd33491fcf48b10e78465b5094c87c9a8792df02a6b89dd9acfe2166c7d6dd235065b161919280dd988c7e297b0a93217c63623cf2ffba101170f052c983

  • SSDEEP

    384:cjrKzK7DGRmhXM1YfjwTJ3b/Vj8CzpDMl+MpK/ckbyy7d+3GM3JcT/r:2eISRm3bwTZB8yJlMuxbyy7d+3R5cLr

Score
7/10
bootkitpersistenceupx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ransomwares\JanusPetya\JanusPetya.exe
    "C:\Users\Admin\AppData\Local\Temp\ransomwares\JanusPetya\JanusPetya.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of AdjustPrivilegeToken
    PID:1856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1856-0-0x0000000000120000-0x0000000000138000-memory.dmp

    Filesize

    96KB

    Download