Analysis
-
max time kernel
145s -
max time network
207s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20/10/2022, 04:04
General
-
Target
89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe
-
Size
597KB
-
MD5
8102b44bf1fec0d45dbf877b225c40b0
-
SHA1
374535ff48daa4eda5c2ac1c76e6dc1a075260af
-
SHA256
89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6
-
SHA512
858b06615be46be78098766381724e58e3a449a5bd6ed533627d61f36a2b91d45bbfe87da059e6f476a70a5d470c84767488eb5d1cc271b79f512958400b74f7
-
SSDEEP
12288:QnvpSu/qBIUxUwicfzGJeINbD3V5GaJDp/:QnvUGRwhSJ3Jtp
Score
8/10
Malware Config
Signatures
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe"C:\Users\Admin\AppData\Local\Temp\89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
600KB
-
Filesize
80KB
-
Filesize
1.2MB
-
Filesize
1.2MB