Analysis
-
max time kernel
69s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
15-09-2022 11:28
General
-
Target
ad1a90f2f253a9adf45be85682d7b44994ab4e8ceafc1a5805316c39c803ccc8.iso
-
Size
2.5MB
-
MD5
a91ca42fe60d0c2d1008e909c8b23cb5
-
SHA1
14f812a695879f33acc81ab32568ed974cdfbea1
-
SHA256
ad1a90f2f253a9adf45be85682d7b44994ab4e8ceafc1a5805316c39c803ccc8
-
SHA512
d409e627d458d753fff8e888f3e211ebf5ad6a11e21b30811e4e46f398f7fa93a033deb97c8acc6e0a5b98c852cc0b773c83cbbad4130db3d3f8a5ae06f8e232
-
SSDEEP
49152:/Y8+6OwVQpMQ08Fk1BGrXN3fLXZOMU9EeF2gYNpJsv9:/g6OXp0KC0rXptVeum
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ad1a90f2f253a9adf45be85682d7b44994ab4e8ceafc1a5805316c39c803ccc8.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken