Analysis
-
max time kernel
153s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
22-10-2022 10:22
General
-
Target
硬盘诊断工具(HDDScan)4.1汉化绿色版/HDDScan.exe
-
Size
6.8MB
-
MD5
3ff91b72787a4124cfe771ad90ae472b
-
SHA1
a10d4ec1fa57f10edf050dc32ad34bcfceedc1b7
-
SHA256
a3938cb21a50964f569499c7d8e3792e22b0d212f089015223b75f4bf7ff0d99
-
SHA512
21fc9ffe701d7202cff6298b94b17665bb1559f5aa3fc22912ed1fec4c26d1f17241bf04e9b40a56dc778e4aee6b2c4d7b50ead60d48421f39a62b38668f7d75
-
SSDEEP
98304:v0MiKIR1tM+avVbjTiK5U+/0AGtmB4EmJIxSIcjT:cFf96feK5Dxb8
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\HDDScan.exe"C:\Users\Admin\AppData\Local\Temp\硬盘诊断工具(HDDScan)4.1汉化绿色版\HDDScan.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx