Analysis
-
max time kernel
89s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-06-2022 11:50
General
-
Target
109a216857539aa776566e6014aa606f093ce975de88874f2b3258ab1fd0bf0e.exe
-
Size
1.6MB
-
MD5
08dbfc47aec70acac66af9b72e05d368
-
SHA1
e1c23b49cfcf7593f05ce4c9e60c4a009919fda5
-
SHA256
109a216857539aa776566e6014aa606f093ce975de88874f2b3258ab1fd0bf0e
-
SHA512
5161f8ea4d753bb340f36e596c34c05a801a7b83cbcded773e5cc918b96dedd0856c5dc70ecc8af2dfb6ad41c1ca518353441fa2fd99691124837d6fd796d8ea
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\109a216857539aa776566e6014aa606f093ce975de88874f2b3258ab1fd0bf0e.exe"C:\Users\Admin\AppData\Local\Temp\109a216857539aa776566e6014aa606f093ce975de88874f2b3258ab1fd0bf0e.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage