Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 16:44
Static task
static1
Behavioral task
behavioral1
Sample
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe
Resource
win10v2004-20241007-en
General
-
Target
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe
-
Size
5.5MB
-
MD5
8721a0da1f73952ccb9c0656db9adfcd
-
SHA1
55d68e1f72c1a431b7d2792bacdd59795bda8a90
-
SHA256
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb
-
SHA512
2237debd13d4e9a29899cbd9a6cd07c53f88167334bfb9feaad0705d610cdbc4f6322237745058f914ec46b68c839637b3e305724edc1a628b2b6fbfcd948748
-
SSDEEP
98304:l9cbdO5jUO9Trz2zObl+6Bn88V/sc/FNVnqyhs8UaBJdxZjUHlzMyZav:l9cUPdHlF9fFhJUaLdxFUHl4Xv
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\AlertaRansom = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe -alerta" 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exepid Process 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exedescription pid Process Token: SeDebugPrivilege 752 3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe"C:\Users\Admin\AppData\Local\Temp\3d9121126e7e6d0abdf10e7bc198f35ff84dbe1a95cadf4a5a9353b2103e6bdb.exe"1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752