Analysis
-
max time kernel
18s -
max time network
122s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
16-07-2021 07:04
General
-
Target
c175e5125ab14f67e2e59301a0d6a6f2a770f4f5731bb6cb3bf37f6253ce4f60.exe
-
Size
1.7MB
-
MD5
7ed622a78bd8afc3c3891379febcf640
-
SHA1
43758603237366de8594e2eb353414148b09ddfc
-
SHA256
c175e5125ab14f67e2e59301a0d6a6f2a770f4f5731bb6cb3bf37f6253ce4f60
-
SHA512
013941579b00ae7f22a5f65df29992fae96637041e91856cc856168732214057d19a3412b6336ca6ca182cfa7a69c66958741769067f828ae75a240445bd5ec4
Score
8/10
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c175e5125ab14f67e2e59301a0d6a6f2a770f4f5731bb6cb3bf37f6253ce4f60.exe"C:\Users\Admin\AppData\Local\Temp\c175e5125ab14f67e2e59301a0d6a6f2a770f4f5731bb6cb3bf37f6253ce4f60.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\INDESK\NewkeyLauncher.exe"C:\INDESK\NewkeyLauncher.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-