0774ee18a57ee8a20d7f355f23a6b7f049dd93c251e2cc9af0100e92a3526547

Resubmissions

04-04-2024 10:25

240404-mf9csada39 10

04-04-2024 10:18

02-04-2024 03:00

02-04-2024 02:52

31-05-2022 01:49

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-04-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

global_ie9.css
Size

1KB
MD5

8b034c820a379291e68132c8aa38e99b
SHA1

72cf8934e03aae9879a392c694a00717c6835cc4
SHA256

dc4c3c5f759484e72d38a1a5ab84f2aebda7f66fb4faa09b0626bfd804419e1e
SHA512

42dedb8c2f66c36060ed4dcc86f69a6eab1d8949bab6250f2642de724c9a972c815fab2154d4772ebd3f519852e53b280fa7610f1485aa9e9fa0b041bd288ca0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2528	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2528	2044	cmd.exe	29
PID 2044 wrote to memory of 2528	2044	cmd.exe	29
PID 2044 wrote to memory of 2528	2044	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\global_ie9.css
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\global_ie9.css
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads