Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
08/07/2024, 07:29
General
-
Target
RansomwareV2.exe
-
Size
90KB
-
MD5
c9f28e5d8dc5daf0aa0bdc7e9c4016f3
-
SHA1
6ef3061d03967fbb97e91b31a28287e0a3b62ce1
-
SHA256
f5db12fc4433acdbb970117ff49a953ffa4a8819dc81d3b58f1fc6d905229e73
-
SHA512
3843b31040f587cff4f87b9bee32718cca7fd3e391fc710a7c46376fce8876f840469627102cd830c5dd83fbc60d502c823bcc390ff45d11f94c58bbd2f583ae
-
SSDEEP
1536:z7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIf4wsO9:v7DhdC6kzWypvaQ0FxyNTBf4o
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 21 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RansomwareV2.exe"C:\Users\Admin\AppData\Local\Temp\RansomwareV2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\76C6.tmp\76C7.tmp\76C8.bat C:\Users\Admin\AppData\Local\Temp\RansomwareV2.exe"2⤵
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55d01eb90db7d8f5581e53bdd3f860358
SHA11931032165834a04a0f55718ab9d094a784228ae
SHA256dee16c767aee8cca2783398b1e8f35417c615197706d3b138b79b5fb8b77937f
SHA512f248c44ecd8f55aade9d71e76f66eafc2dc4b1f185d34f29ce13ad9a0f489304eb55c2be69b3276f731118ce487edec02a41fb1442af52957033176ba330e2e9
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB