Analysis
-
max time kernel
91s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
08/10/2022, 21:15
General
-
Target
4633a0b05cfb6640ceeb2550666b93713baf633970944764a0d1c013983e6fd0.exe
-
Size
730KB
-
MD5
fcec5f857197078cf4cd2d773fc5fcfd
-
SHA1
4ca1031ce6974b7d10f9e0b14fcceb9ef6da28c0
-
SHA256
4633a0b05cfb6640ceeb2550666b93713baf633970944764a0d1c013983e6fd0
-
SHA512
ffc18f00353a9ceeebb97dd8a6911cf4200c74bf0bf4cfa1f4370ce76250508cdf19d06ecbca1b070439981b1fcf7a9bd02ade350905f0fc366a9f321c3998cc
-
SSDEEP
12288:X3lGUQuLwm9u91VQg2opqfm2+CIIw8mWWL/ocpw6wil5/YS2BQ:X1FQ2mC7hfm2nIh8LcGil5/YSEQ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4633a0b05cfb6640ceeb2550666b93713baf633970944764a0d1c013983e6fd0.exe"C:\Users\Admin\AppData\Local\Temp\4633a0b05cfb6640ceeb2550666b93713baf633970944764a0d1c013983e6fd0.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx