Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
18/09/2022, 23:37
General
-
Target
SpywareRemover/SpywareRemover.exe
-
Size
16.2MB
-
MD5
6c65de63bae1c40fcda43c6aae2f43f5
-
SHA1
ba50254ee08d0ad636b12d7d4d7f7fbb72b9a0fe
-
SHA256
d06f8b3572bc44d8514905356a4b0076f8fb6eccb72bc92ebc3f7b7794902f19
-
SHA512
7782f3e099ef9dffcfb7f13b249de2acefb00a30caa4360ae3aaacd69c12c3216b217f4d3078962bfb0533db4faadab7bf3c2d38a36f3a70513ee77e33abcb0e
-
SSDEEP
49152:6IEhXOV6oOjrRQdytWFPfNYwsT71+PQgs43ycMwdJiV96mVd27Ql4rGuoO/5C:6HXcsd4yMdfmh2MUJHy4r3oy5C
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpywareRemover\SpywareRemover.exe"C:\Users\Admin\AppData\Local\Temp\SpywareRemover\SpywareRemover.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx