4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d | Triage

Resubmissions

29/07/2024, 08:41

240729-kls7msvard 7

28/07/2024, 03:15

240728-drxnpaybpg 9

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 03:15

Sharing

Report Analysis Logs

General

Target

edited_ransom.exe
Size

12.8MB
MD5

54c99a11b63dc6f7a017289073850e9d
SHA1

9ee4d0bf7cd780aacd437ff0b21e011bf5e94649
SHA256

4373afaa735149fa377994bf045b5ea884dacc3b709de121269abc087c10187d
SHA512

c569cbd59214c780bd4cb81e0d509ede88e29a1d587ad7f860824e29985162967d9176cbdbff8c80501db8fbf2eb69e1dbfd9f9af9f3ba09f3c9c91941268dd7
SSDEEP

393216:sqoJWQsUcR4NzK1+TtIiEY9Z8D8CclyhCW8SInoXx:stYQFS1QtIla8DZczW8S

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2796	edited_ransom.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2796	2912	edited_ransom.exe	32
PID 2912 wrote to memory of 2796	2912	edited_ransom.exe	32
PID 2912 wrote to memory of 2796	2912	edited_ransom.exe	32

C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe
"C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe
  "C:\Users\Admin\AppData\Local\Temp\edited_ransom.exe"
  2⤵
  - Loads dropped DLL
  PID:2796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI29122\python312.dll

Filesize
6.6MB

MD5
3c388ce47c0d9117d2a50b3fa5ac981d

SHA1
038484ff7460d03d1d36c23f0de4874cbaea2c48

SHA256
c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb

SHA512
e529c5c1c028be01e44a156cd0e7cad0a24b5f91e5d34697fafc395b63e37780dc0fac8f4c5d075ad8fe4bd15d62a250b818ff3d4ead1e281530a4c7e3ce6d35

Download Submit