Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
25/06/2024, 14:53
General
-
Target
Label_Copy_UPS.exe
-
Size
74KB
-
MD5
e9effb8cef2374eb9ad40a33e2429c8b
-
SHA1
aee4bd64303dab698e0de0767e46a606973b63af
-
SHA256
9f86b6455a11922922a9578cf3411cb6f257705b25a7771abcb13dc7b7bbbc30
-
SHA512
50ad3a370571f49df47ea01ad279a8fd6eda19d6eda7ebe5d4e0fdc09d5b5c3d3e9bb17cdc94ee67dc378e18e77dc474f3300d7f7591f94034c498289ff84dc6
-
SSDEEP
1536:sMVRiIivmfYjxb3Ve7Sc12sOWASU3BVg3ScDnI1QKEFXvxdqHsH:sMHiRefYjFs7Sc1yTSUxVoSkICX5ym
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Modifies registry class 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Label_Copy_UPS.exe"C:\Users\Admin\AppData\Local\Temp\Label_Copy_UPS.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Label_Copy_UPS.txt3⤵
- Opens file in notepad (likely ransom note)
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD543fb2705d9766ea761f934981936503f
SHA1c9589c81355baab345cd121a76dcd743d65e131c
SHA256766a90366e6cac315d05afc9c97dcd6206a7f66da260dd41d209bb6ad13947e0
SHA512ebf82587e4a8dad580b0c6c6959c73315c584cea82c41c073aab41854a44027fbc63d3f360651e726bfe71bc9e99a1b803574715e63d462f90182291ce3dfbf4
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
128KB
-
Filesize
104KB