Analysis
-
max time kernel
1562s -
max time network
1563s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-03-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe
-
Size
12.6MB
-
MD5
a0cd8aa1cd7cc61d41977cceacd7d4f6
-
SHA1
83078ff956e5e441429257cfa3a3362d6ba3c0d5
-
SHA256
df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c
-
SHA512
2f147b25d3289f33623dd3fdfd339de75b71cab4eb6348d0a176815bc1a7a86889113c40b6b1d3a2eb275fd76c16dbbe0eb38e63584ce2f5005a13c7369e68db
-
SSDEEP
196608:zRXBBaGSqkZRLVupoP3/ih4a4kZLm77gZ9rwaATAZjiEjOvonfT:p/+j/ih4a4k9M5kjiOOvonfT
Malware Config
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2604 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2604 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe 2604 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe"C:\Users\Admin\AppData\Local\Temp\df8d000833243acc0004595b3a8d4b66fcd7b76d8685d5c2ff61ee2a40a0e92c.exe"1⤵PID:2932
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2664
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2604