b68c805282f49d9422d3495c2b8495da43b927c6d11fddb8605e0f80bf29d7df

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/05/2024, 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Ninja_Ripper_FREE.exe
Size

21.8MB
MD5

f0f4a3dd1cb2749dc6c120c52eec2ffa
SHA1

37a248278b6470d271f2db9d963d8e56da8146f9
SHA256

b68c805282f49d9422d3495c2b8495da43b927c6d11fddb8605e0f80bf29d7df
SHA512

fc85b0652d770751e9f32768e0154c74064f31533a20510977431fa7f83182a991bc1ea31bf255411637f1b6563d929bad4dc0f6eaf604794f7d2f3ff46f392b
SSDEEP

393216:iYKeV+raz4kWUuuOZzNNkw5or64bOmYMIk3SCKpLkx5mQnogriY8Lbopz6j3ZSOP:X8Nkxuf34KPMT3lF8L8p+FrP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
868	Ninja_Ripper_FREE.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe
868	Ninja_Ripper_FREE.exe

C:\Users\Admin\AppData\Local\Temp\Ninja_Ripper_FREE.exe
"C:\Users\Admin\AppData\Local\Temp\Ninja_Ripper_FREE.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IF{E0BC5056-CE96-474E-A7E4-5995881D29C8}\English.ifl

Filesize
2KB

MD5
2922d0c758d9c3c10cbdc59f91979d0c

SHA1
feb69bdf58d06cca776db63036811af0764ca013

SHA256
20f6d12eac29bd6ddc6a99dd276c5e200fac25c976ab4293195b58ec164c253f

SHA512
d15e888bae4e23ce5d61becc3c47d9b5f61fbbe4612cf90677314570fe1df1f4fde6c519b789ad46cc50d19c2b3701bc9bd968e85bb618fb7127950d4ae92695

Download Submit
C:\Users\Admin\AppData\Local\Temp\IF{E0BC5056-CE96-474E-A7E4-5995881D29C8}\licence.rtf

Filesize
133B

MD5
2c4ff61648322d9ea2d472c2683d421c

SHA1
6eeea0c4e79d801d48d86fee28de55007d914d84

SHA256
d91c1bcdcdcbab883d1e145f8bb54fe09a5544e0e979283c55cc2a06ef7d1e0b

SHA512
56b3613a72629fdcace42c9ef044f3f34bbbb25d938fc9d189db4d3759a26363728815403ecf017857f372d6b18b3b271c5519736b714cfadb8ebb4801b5b480

Download Submit