Analysis
-
max time kernel
99s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
02-10-2022 00:09
General
-
Target
85e91de5fd39adae9eedc85da3431b50fe5b163a8729adbb7bb9d1596f9417c3.exe
-
Size
120KB
-
MD5
6f3571320ff03c9995fd17d033b2663a
-
SHA1
b3b746adeb322a0b8f4ae07853dd71e7e6f12938
-
SHA256
85e91de5fd39adae9eedc85da3431b50fe5b163a8729adbb7bb9d1596f9417c3
-
SHA512
3b4f5ceef33d44693a21d34dfef36609e486ec50538cdffd7986ead0be38cd3fddb3a49a51bbf09f574f1c5b2567349dee1c0d5bd006d09e5816dfe8ac5e73dd
-
SSDEEP
1536:ifFGwLjZmlOxPflNcySIDLeUaoASZAKOetYXPcsx694XtPGT:naZmlOxPfg6LFaowKOeGXPcW0N
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85e91de5fd39adae9eedc85da3431b50fe5b163a8729adbb7bb9d1596f9417c3.exe"C:\Users\Admin\AppData\Local\Temp\85e91de5fd39adae9eedc85da3431b50fe5b163a8729adbb7bb9d1596f9417c3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx