Analysis
-
max time kernel
98s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20-09-2022 17:09
General
-
Target
46780d5ce0a86f94e781c7e474fcf8e9.exe
-
Size
108KB
-
MD5
46780d5ce0a86f94e781c7e474fcf8e9
-
SHA1
0b294a871448f018e3612fb31509fb88aad1d459
-
SHA256
0cd80848290829e881bbcb30f64651a2e319b1aa8db5d88c50d0d1052ebbbb1a
-
SHA512
2365e16922c588e94d09188f8ef99560a8b4d9e7aed2e1620d38e72b366946cb8952fef1d1794b034a8ba056c850ea3f76118c529fe016bc7174012c362bf902
-
SSDEEP
1536:CDtR+Eo5utW314ZVApz94OnJKFQEphZvD8ECtei+NLvlsgDF:6tkEoAWF4ZCD4OnYQqD84JvBR
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46780d5ce0a86f94e781c7e474fcf8e9.exe"C:\Users\Admin\AppData\Local\Temp\46780d5ce0a86f94e781c7e474fcf8e9.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
88KB