Analysis
-
max time kernel
151s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
07-01-2025 03:56
General
-
Target
asss1.exe.zip
-
Size
7.5MB
-
MD5
1b7999617f5074264506cd78e46ffd12
-
SHA1
8b298be0aa2f0df68a62028d71e5f557c134318f
-
SHA256
a998493c66df7decf160160847d3a8c2413fc1938a0e586cfec472c8856bd8b9
-
SHA512
a80fa2d906ce9a04854a5ea705731eae31d9b9d059237bb2b664d6a710e7e46c13f1dfe8b8bcea1a3b1154994442ec93d3630c95588cfaf4ba78396c4e62015b
-
SSDEEP
196608:fOIIa6yMxIIyXLaSF8g77UQXMIwZ9SXIlHDdzrli:GII7bIncIAQcj+me
Malware Config
Signatures
-
BlackCat
A Rust-based ransomware sold as RaaS first seen in late 2021.
-
Blackcat family
-
Executes dropped EXE 8 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 47 IoCs
-
Suspicious use of SendNotifyMessage 44 IoCs
-
Suspicious use of SetWindowsHookEx 17 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\asss1.exe.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /n "C:\Users\Admin\Documents\GetExpand.xltx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\PublishRead.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\asss1.exe"C:\Users\Admin\Desktop\asss1.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD5874f7cf98042de6131a1fb727aac433f
SHA10b19f3e03fbc27998cf7926305b1687b17b8b3bc
SHA2568e7ef0c47ffd84da4c23cbaf99694db4a7ee8410c691bc8d98f9f3ec20caf48b
SHA5123d68091a9712f96096361e319e00bba3982835ab71e78b4d29d5be4f07c0dcc14464ba2ca04dd4c239ecc0e4d185885dc4808de2f544b5b32a9d7f321eb0af49
-
Filesize
2KB
MD50cb286c0c7e4178d531cdd898755f7b7
SHA179383a865274135684e4ab8a46404c77abc28f4a
SHA256bba4203c55cbd11d0df7c75424b18a27495cefc52b2e588e3b612abeb019299b
SHA512c260e417375527a1a0d1b455fefee545e9f43b5739444783661af84ba88e1e2fbcbd5d99976f2057fbe8074c98fc8705dc6c479a7e91886f4358962c645bfe22
-
Filesize
2KB
MD59df1cced0cbac140ea47f3354d1f0bcd
SHA194430464223d6914d18f93e2f39fb6725593feab
SHA25681e5d1731634fe95fadd92e4f795c0bedf7c9d98ce125adbd05842182c61ee09
SHA512111d86d50d1a8d99397f4f2a3756e60d1c0d1d5cf1a575011bc51b9596456652a8d82f379793ce90cd20e8d8561dfc752d6ee9feaeae413302e31a613655a684
-
Filesize
351B
MD58f90a3fe8e6f5dc8fd53969cd9feb6b5
SHA17683c1bcfa0b25ec8845014f137deac889aa9659
SHA25684916d30bdfb9a50f95e289c48ea9aa81dab989ff4b7a33d2486a35b1adce67f
SHA512d69ace12525253a80a3bdbe228f087a0c039c4a37e11d4b3d3003d72840146518e1e4cf7c79e0aa02cdc60d5640098e7c25a48cd4d6df64c23ffaf246f711ffa
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
14.3MB
MD5db7a7403e5e248d0e96efe67cef73449
SHA111331c98855fdf42bd94a84687661c682336fea9
SHA256847fb7609f53ed334d5affbb07256c21cb5e6f68b1cc14004f5502d714d2a456
SHA5124fcf43cc7d337dbe17273e217acc6e98617fc153bf1e8295be6ba7b2afe3c7efca86d5e7eddc1fdf1212c74f1cd1803c5b6b0164e4322d89757cc6897b7313f0
-
Filesize
14.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
14.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
14.3MB