f5186f9643e3eac02a888b65ae9b1e354add39f717dfc8843c57163fd81d0c05

Analysis

max time kernel
443s
max time network
444s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
03/05/2025, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1234/calculator.exe
Size 571KB
Sample250503-ff72dsem5t
SHA256 d4fa38fa69e8ca76a9d5fbbb73a9d7e35643ac8f9b5c51777567a290b4835453
MD5 2a158f4387208ec7fc6a850f5bbb8786
SHA1 deba7f1a30aa9ddda1d7e405386485e25e4976f6
SHA512 71d5e944c06f700b3eef3a4371d0148c21503e1b6c7d25256f289e00ad8c61d9ba537e603086b07937c9ff7a24ea36e2f7ea246cef85922773ddeb5e6a64bfaa
SSDEEP 12288:ij6rKeR+d7t5ZHywk3Ta77Hp0fWAUmB0ms7yrSvYFEVuo3A:0Besd7tuJSvYFEVuo3A
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

ransomware

Malware Config

Signatures

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3588213599-686740421-4058676312-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\black.bmp"	calculator.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 584 wrote to memory of 1308	584	calculator.exe	81
PID 584 wrote to memory of 1308	584	calculator.exe	81
PID 584 wrote to memory of 3552	584	calculator.exe	82
PID 584 wrote to memory of 3552	584	calculator.exe	82
PID 584 wrote to memory of 1092	584	calculator.exe	83
PID 584 wrote to memory of 1092	584	calculator.exe	83
PID 584 wrote to memory of 4692	584	calculator.exe	84
PID 584 wrote to memory of 4692	584	calculator.exe	84
PID 584 wrote to memory of 2136	584	calculator.exe	85
PID 584 wrote to memory of 2136	584	calculator.exe	85

C:\Users\Admin\AppData\Local\Temp\1234\calculator.exe
"C:\Users\Admin\AppData\Local\Temp\1234\calculator.exe"
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /K title HI Gay && echo HI Gay && color 0A
  2⤵
  PID:1308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /K title HI Gay && echo HI Gay && color 0A
  2⤵
  PID:3552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /K title HI Gay && echo HI Gay && color 0A
  2⤵
  PID:1092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /K title HI Gay && echo HI Gay && color 0A
  2⤵
  PID:4692
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /K title HI Gay && echo HI Gay && color 0A
  2⤵
  PID:2136

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\3f10c59069234aa8834c8eed6e0ffcc3 /t 2360 /p 584
1⤵
PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

AMGAY_320_0.txt

Path C:\AMGAY_320_0.txt
Size 8B
SHA256 04658563218131ac2fe152e679885ad9b2f4a90e5717432bb0697ae2e526b889
MD5 a94e6ab2cb8fa48f5d74a4448a348630
SHA1 55d9ec513642addfbb628e38acad5fb4fbaef01f
SHA512 1f671d369fbb065c86668318cc4887a0b0c1d5ee7622fef71b2c218d6bedf6f4c7eb228547b974063fee4df28c1ddcedfc9126499eacb70d9e89656c1d963454
MD5 SHA1 SHA512

Submit Download

memory/584-650-0x00007FFCAA020000-0x00007FFCAA068000-memory.dmp

Download

memory/584-649-0x00007FF67BD00000-0x00007FF67BD87000-memory.dmp