ec0ad1f8f2e44caf62b64352630eb4bff5439bf05ad06c8f745bcde91c5a21a9

Resubmissions

21/11/2024, 10:22

241121-mej2hawjek 5

21/11/2024, 10:19

241121-mcqfhawjcj 1

Analysis

max time kernel
92s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 10:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REQ# 826896.zip
Size

90KB
MD5

cf596b7aa12343e6cbada552f01ae7ce
SHA1

d04ef508943d7ba8a619bace242360da065f462d
SHA256

ec0ad1f8f2e44caf62b64352630eb4bff5439bf05ad06c8f745bcde91c5a21a9
SHA512

71159ba126e3f295719255318479b3412595d42fa24c6d36ff467fad0f90938b7ffbdab3aa29c29746b63df2aac3d0c7682560fce89e0a08d16098fcbe3c6914
SSDEEP

1536:wiqoU2+Lig3Atp9MKat6ooroIfbkd4zSOXHfG17vO82tA43e4mb3mZ6O2:wiqm+LEtp/at6ooUIfbr1XHATO8SAWe7

Score

1^/10

Malware Config

Signatures

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2804	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2240	7zFM.exe
996	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2240	7zFM.exe
Token: 35	2240	7zFM.exe
Token: SeSecurityPrivilege	2240	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2240	7zFM.exe
2240	7zFM.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe
996	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 2804	996	OpenWith.exe	94
PID 996 wrote to memory of 2804	996	OpenWith.exe	94

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\REQ# 826896.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2240

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\message__193120241102236488AE6E64_D41A9B20C5_the_urban_institute_de_.eml
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\message__193120241102236488AE6E64_D41A9B20C5_the_urban_institute_de_.eml

Filesize
150KB

MD5
982de19b5185ea342fc0a518d9c3c559

SHA1
8d2074788cb2b4b99c5dc252e9545a2a22a12e7f

SHA256
202a59d3e71acfac0ceb78ba90d0d16a92e97224dd7824af438ad208c391eafc

SHA512
ac5e4285182fc962dbd4aaa8f0d3a308db756a97d7c3cf2ea1f9af22d92b9eda5a1c5a3f4bbbaa931b2749a8d10bbaeb581716d31f62193c95f1f2d116eccef6

Download Submit