Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
21-10-2022 01:27
General
-
Target
0c0d99c032db0dfa94b4a09cbb4e2a7c90635ef71500bafe50ad4865a70d8b19.exe
-
Size
2.0MB
-
MD5
5b6fd88ffa97f22aa7e8ddbcf3cc99af
-
SHA1
e075daaf02abc05f0119c43a83b5086d16bb2635
-
SHA256
0c0d99c032db0dfa94b4a09cbb4e2a7c90635ef71500bafe50ad4865a70d8b19
-
SHA512
0c16777743a81479db8a5ca65b1086b6dd8540767774b3aeb755ebed17b560fcab9276a433e5d39de24892ef1cbbbcd267bc4977f49c2e0af3b12704be2c7798
-
SSDEEP
24576:JRf79yuZg3Iit3+PWSEa9ElD/hnX8Lnxipd5ceqHRqwB+hz8TETMNhMxzg:nRyNxIVZm/9qxad6grz8TkMXEzg
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c0d99c032db0dfa94b4a09cbb4e2a7c90635ef71500bafe50ad4865a70d8b19.exe"C:\Users\Admin\AppData\Local\Temp\0c0d99c032db0dfa94b4a09cbb4e2a7c90635ef71500bafe50ad4865a70d8b19.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
8.7MB