Analysis
- max time kernel
151s - max time network
173s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
25/06/2022, 09:24
General
- Target 94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe
- Size 99KB
- Sample220625-lda7jaefej
- SHA256 94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe"C:\Users\Admin\AppData\Local\Temp\94d9cfda3e2a60aea012b0948c9f9eaf55d1f7d90fb1bc9e9c094a3a064669ad.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3548-130-0x000001B350080000-0x000001B35009E000-memory.dmp
memory/3548-131-0x00007FFE125B0000-0x00007FFE13071000-memory.dmp
memory/3548-132-0x00007FFE125B0000-0x00007FFE13071000-memory.dmp