Resubmissions
15-06-2024 17:25
240615-vzf5casdqm 315-06-2024 17:24
240615-vy3xqasdpl 315-06-2024 17:22
240615-vx1qzaycqd 4Analysis
-
max time kernel
122s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-06-2024 17:25
Static task
static1
Behavioral task
behavioral1
Sample
Bruh.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Bruh.zip
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Bruh/here.txt
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Bruh/here.txt
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
Bruh/honeypot.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Bruh/honeypot.exe
Resource
win10v2004-20240508-en
General
-
Target
Bruh/honeypot.exe
-
Size
2.4MB
-
MD5
ab82e4c0bcb8bda3df172b6360a06b94
-
SHA1
e41217abdee78d9e5c3835bf57a8d460a3da13a0
-
SHA256
48e8733462baa85a1afd34a8dad588a989f431b12e2361001d95d5963a8f0da7
-
SHA512
ead1b0f74d9a3fca1460c809012655feada85d5160191debafce959b655d89f1f8c815b0401cb43cd1c980dd32bce50164952a1e74f33b918353f6237e62d99c
-
SSDEEP
49152:hLjq/dlOM7qMjRnBJ/MzV47Zb/9BPABYZ77/RFkqXfd+/9A9TSanGfeKdb:p+dGMjRT/eV4dJTkqXf0FoSW
Malware Config
Signatures
-
Opens file in notepad (likely ransom note) 2 IoCs
Processes:
NOTEPAD.EXENOTEPAD.EXEpid process 1628 NOTEPAD.EXE 1120 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
honeypot.exepid process 2972 honeypot.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
honeypot.exedescription pid process Token: SeDebugPrivilege 2972 honeypot.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
NOTEPAD.EXEpid process 1120 NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bruh\honeypot.exe"C:\Users\Admin\AppData\Local\Temp\Bruh\honeypot.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2704
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Bruh\here.txt1⤵
- Opens file in notepad (likely ransom note)
PID:1628
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2224
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Bruh\here.txt1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:1120
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2972-0-0x0000000074C1E000-0x0000000074C1F000-memory.dmpFilesize
4KB
-
memory/2972-1-0x00000000008E0000-0x0000000000B48000-memory.dmpFilesize
2.4MB
-
memory/2972-2-0x0000000000490000-0x00000000004A4000-memory.dmpFilesize
80KB
-
memory/2972-4-0x0000000000860000-0x0000000000894000-memory.dmpFilesize
208KB
-
memory/2972-3-0x0000000000580000-0x000000000059A000-memory.dmpFilesize
104KB
-
memory/2972-5-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB
-
memory/2972-6-0x0000000004AC0000-0x0000000004C36000-memory.dmpFilesize
1.5MB
-
memory/2972-7-0x00000000020E0000-0x0000000002112000-memory.dmpFilesize
200KB
-
memory/2972-8-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB
-
memory/2972-10-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB
-
memory/2972-9-0x0000000002480000-0x000000000248E000-memory.dmpFilesize
56KB
-
memory/2972-11-0x0000000074C1E000-0x0000000074C1F000-memory.dmpFilesize
4KB
-
memory/2972-12-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB
-
memory/2972-13-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB
-
memory/2972-14-0x0000000004FA0000-0x000000000504C000-memory.dmpFilesize
688KB
-
memory/2972-15-0x0000000074C10000-0x00000000752FE000-memory.dmpFilesize
6.9MB