Analysis
-
max time kernel
166s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-03-2024 15:13
General
-
Target
1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe
-
Size
716KB
-
MD5
cc3f68e8a50b05aa77d88b6119583b9e
-
SHA1
71c7b93a8947265fe30e6928730504a5456ca788
-
SHA256
1dd70e803623d5311b71129976710b11a8942d206a5d8d86cdf8417255f15725
-
SHA512
e4fe7c8ec1d88c0bc81834de0a1212902849d7c9f6228e26fb8aaf3f046011f934d6de01becb339ab88169533ff8dc0d6fad7d6d7ff7e956e408242a21809e55
-
SSDEEP
12288:ZMMpXKb0hNGh1kG0HWnAsaHy41Dxm1zRRaMMMMM2MMMMMu:ZMMpXS0hN0V0HYah1I1zRRaMMMMM2MMd
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Renames multiple (93) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Drops startup file 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe"C:\Users\Admin\AppData\Local\Temp\1DD70E803623D5311B71129976710B11A8942D206A5D8D86CDF8417255F15725.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
716KB
MD51aca88f20585a887fdf4ed3ec4874d50
SHA17c4f881c18a6e429532f879fb2528d6f0ec0788c
SHA256af2443c488709c1206dcd4c0dfc748fb9389ba4e7a28b01b8c31039a0ba4e7c9
SHA512a4fc594f2aa10be2c3f37661b39ee33fb7e82007aa0eb1ac8cedd828713ff76137acbcda854e874653f855654f0d41ff5095cca7a6880144310e6bf5c0d75057
-
Filesize
1.5MB
MD56ed3a73e9300470c24d19006f723000c
SHA1ee724e84b5bba75764d40e1e5e58b6c06a1b653b
SHA256d76a3fa170282ef655ef48e232b906130ed5f59185b332b809feba8b750c4752
SHA51283ec2ba53271ddf49bf8bdca108b56b3371cb1d6724531a017583c5e2a50703fec49c7a022ce63bb804b5ebd543a9c66b2e362a8d8ba692e1b6d727e87c2fabb
-
Filesize
1KB
MD511e39be67de9d634f9f9e2e56ea00cc4
SHA180fc26054a306f00bed0f587c068eed4e8c847c6
SHA256ec27aed7da3ea03da374926ab1264f311aac528099f5d23ffce72aa2be3b9c5b
SHA512eecd46cf4e2f233b358490c40594fc4c738a075a7605f75a04c92d963cd7418e9a8ce9648aa9a2d71e1cc96c080d57122665872b15737ee2a4cd48958933474d
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
4KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB