df025008bab8a9d1b780276526007d60abaafb894af2cca82bc633c715945ec5

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45031a9738ccab5f9cf3a399c5ac0374.exe
Size

2.1MB
MD5

45031a9738ccab5f9cf3a399c5ac0374
SHA1

933ac6f5a5316b47ae8e9e808022058db565d8fa
SHA256

8c56eb191159283133ef2e71898f39e75b14decb237ca5f98911ca1394dcb44d
SHA512

b3ca645819df6325e985063799e505a1837cf56585a27ddf599ce397cd50ab28f926c4af9270da8b5fc8038188d28c4342ecaf78f1ab09f3fcb84f2614e58000
SSDEEP

49152:b/FBVWix5TC0/5ljAhscAWlMym/HXR1supwJ4Cf:

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2356	t44oezrs.kfl.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2884	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 2356	2532	45031a9738ccab5f9cf3a399c5ac0374.exe	30
PID 2532 wrote to memory of 2356	2532	45031a9738ccab5f9cf3a399c5ac0374.exe	30
PID 2532 wrote to memory of 2356	2532	45031a9738ccab5f9cf3a399c5ac0374.exe	30
PID 2532 wrote to memory of 2884	2532	45031a9738ccab5f9cf3a399c5ac0374.exe	31
PID 2532 wrote to memory of 2884	2532	45031a9738ccab5f9cf3a399c5ac0374.exe	31
PID 2532 wrote to memory of 2884	2532	45031a9738ccab5f9cf3a399c5ac0374.exe	31

C:\Users\Admin\AppData\Local\Temp\45031a9738ccab5f9cf3a399c5ac0374.exe
"C:\Users\Admin\AppData\Local\Temp\45031a9738ccab5f9cf3a399c5ac0374.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\t44oezrs.kfl.exe
  "C:\Users\Admin\AppData\Local\Temp\t44oezrs.kfl.exe"
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\config.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\config.txt

Filesize
1KB

MD5
d1884260943c5b6238ae7f039a445c0b

SHA1
a2483bc672009e0e748bd6be623de216337e77b3

SHA256
f538df6153b2e1d1b1368d17a1d236f2c6b952469fd57f606db6787490d4103f

SHA512
a42c61e2c148ac01509d7980ad135215b758d25556acc1d7b6bea8eaa11156e5fa64c1a2a709c1859f49d6cc78b281511c543eafed04a2ac9493e2bd773cf8f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\t44oezrs.kfl.exe

Filesize
777KB

MD5
67c847973f3c013e3e5049f6a82ae1b5

SHA1
ddd92d14cc4c4e1e5a3afcb24087f997e63f561f

SHA256
0efeb9b6ed577e71905b9944d794da8ee14084c6cde61d5bb695c10448c75933

SHA512
eff87736136998b54fdd952b4e85fa800d13bad9ffa9863dd55595f3e7ca2c557cf0ba45ab47fb06f79ba6efd07294f8f1fab30cd81c5b9bcc5e02f25419c86e

Download Submit
memory/2356-8-0x00000000013E0000-0x00000000014A6000-memory.dmp

Filesize
792KB

Download
memory/2356-10-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/2356-11-0x000007FEF6640000-0x000007FEF702C000-memory.dmp

Filesize
9.9MB

Download
memory/2532-0-0x000007FEF6643000-0x000007FEF6644000-memory.dmp

Filesize
4KB

Download
memory/2532-1-0x0000000000F50000-0x0000000001168000-memory.dmp

Filesize
2.1MB

Download