Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2024 23:23
Static task
static1
Behavioral task
behavioral1
Sample
Trojan.Ransom.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Trojan.Ransom.exe
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
Trojan.Ransom.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
Trojan.Ransom.exe
Resource
win11-20240221-en
General
-
Target
Trojan.Ransom.exe
-
Size
49KB
-
MD5
46bfd4f1d581d7c0121d2b19a005d3df
-
SHA1
5b063298bbd1670b4d39e1baef67f854b8dcba9d
-
SHA256
683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96
-
SHA512
b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5
-
SSDEEP
768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Trojan.Ransom.exedescription pid process target process PID 3460 set thread context of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1064 4024 WerFault.exe Trojan.Ransom.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Trojan.Ransom.exedescription pid process target process PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe PID 3460 wrote to memory of 4024 3460 Trojan.Ransom.exe Trojan.Ransom.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.Ransom.exe"2⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 3403⤵
- Program crash
PID:1064
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4024 -ip 40241⤵PID:3008