Analysis
-
max time kernel
179s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
-
submitted
31-07-2022 18:09
General
-
Target
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe
-
Size
756KB
-
MD5
30cd1eb2e9eb2de1b915df13e69d9ab5
-
SHA1
b08ebca830448d2607741169c8c96de385b90a92
-
SHA256
5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932
-
SHA512
1d64fc1205609d4e3139dc43340e8e62c81810ddee9ab532883dda49b3c315292c3e826071effafbb8b4aabc61ffe3587f5e8fdc7bb384a4e05ceeba8bf2f9bb
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe"C:\Users\Admin\AppData\Local\Temp\5f21c7279140fe637b951a0678c7fe6fd84198a43cf26d3b21e1e37ebc12b932.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken