Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
04-01-2022 22:34
General
-
Target
超级录屏_012518458.exe
-
Size
1.0MB
-
MD5
afb5eb75439fa4ecf9528e6f6f801cbc
-
SHA1
de092c132dac08a4658574c27c9d69a118a21192
-
SHA256
2a31d6d76afa26824ce81b6e69397d078607a62c783f8edf2146249c9cb6c29a
-
SHA512
f44de18f8f9b66ddb906f9e8399362ed883c4065931f07e8a5283af04e1cc437ae225d574882955261cac218c914c7ddddcd9ef6827c018d582b95a25c86cb72
Score
6/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\超级录屏_012518458.exe"C:\Users\Admin\AppData\Local\Temp\超级录屏_012518458.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses