Overview

overview

7

Static

static

1

ipts.7z

windows7-x64

3

ipts.7z

windows10-1703-x64

3

ipts.7z

windows10-2004-x64

3

ipts.7z

windows11-21h2-x64

7

Analysis

  • max time kernel
    193s
  • max time network
    200s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/08/2024, 12:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    ipts.7z

  • Size

    42.0MB

  • MD5

    e008dd5d08710143026f8cd79111b1af

  • SHA1

    dc24abd2d9cfeb6a9d718dc41491b0758a1b9d32

  • SHA256

    d52d424ce932e11fd80a426d866dd83de463b6b403750801acd871b706327a39

  • SHA512

    97665c0d8c10fd953405e54eca9662bfd2905caba2949f34dbf2133c304d41eb7be4bbf6ca9d7884e8c54aee6e9e349a12013145ef248daa24e658b5d4471119

  • SSDEEP

    786432:EKUu9Oiq0RnRcAS1LdvSiWjU4nLMjkMjE61pXqMdljceAit97P:EKpO09RcAWvSrzMVFyitd

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\ipts.7z
    1⤵
    • Modifies registry class
    PID:3984
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\ipts.7z
      2⤵
      • Modifies registry class
      • Opens file in notepad (likely ransom note)
      PID:516
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ipts.7z
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2552
  • C:\Program Files\7-Zip\7zG.exe
    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\ipts\" -spe -an -ai#7zMap15185:64:7zEvent13274
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4428

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\Desktop\ipts.7z
          Filesize

          42.0MB

          MD5

          15ccf12a45031270b39801e28501fd26

          SHA1

          9ecb6e707f427c7be858408c68a3b6e9979bc57c

          SHA256

          712ce634533867177d0ba04f3d9566ae2a2088266565ce7ae6e813eeb7e8f30a

          SHA512

          b3ea146fa51e93e17fef4eb18a93879b882b8ed1dc543cf54122fffc839a00ae31398ee41bf15c73d0bcd91cf255ba5331b35fb2987b382bcf55c7626702cc55

          Download Submit