Analysis

  • max time kernel
    251s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    20-07-2024 14:23

General

  • Target

    big fat sexy dildo poop ransomware.exe

  • Size

    1.1MB

  • MD5

    365c420055e65efc397235b48a937354

  • SHA1

    1fa4f99856a1f4b34e916c5c38d7919b993787a1

  • SHA256

    1ba17c343abc3076637a5b744c02920058116a7ea88e7476912aa69162963243

  • SHA512

    bde2ae9b1f7dcfc0d51d0e423ec6c156217b5fd7756fb690761b7aaa8f2e4131a1ce5a2ae5b751b29e63ecb55c950683c4cb58287796b3fbb9c29c8bab02d840

  • SSDEEP

    24576:yxAQJ89kVyjJRGqHT3+nLmuqennVUHY2Xa3411TokYv+:y1Sk+GqHT+nLmknyK3SkkW+

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\big fat sexy dildo poop ransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\big fat sexy dildo poop ransomware.exe"
    1⤵
      PID:1640
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1132

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1132-33-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

    • memory/1132-34-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

    • memory/1640-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB

    • memory/1640-8-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/1640-9-0x0000000000400000-0x00000000004B2000-memory.dmp

      Filesize

      712KB

    • memory/1640-10-0x00000000001C0000-0x00000000001C1000-memory.dmp

      Filesize

      4KB