Analysis
-
max time kernel
2s -
max time network
2s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
12-10-2022 18:11
General
-
Target
file.iso
-
Size
6.0MB
-
MD5
e1e9ac408a47b99a37188d22b50905d8
-
SHA1
2a38bc508a5549c68d1817f2d7bac95cdfb57b54
-
SHA256
857bf238a4efbb5f6352f0467e29c1ef4fecbdf3bcb0f0461da9da80a7c0e842
-
SHA512
afa8a5ad6c69b086f3f0d53b45f44264b2d25dea09c97ce193194d2f7b6844f802c8b4d591e7bb61e17c66eb74517bbcd4971a214ddcb9e7cc94115c1e156bc5
-
SSDEEP
98304:XAC9AGDm8MytOY9woKC4BDBwWlKylZ/FxCeMxlGV9GZRik9VI5TMwGP2KEg:h9mzytc/CKDllTllCeue6STzA
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\file.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken