Analysis
-
max time kernel
101s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
30/10/2022, 19:47
General
-
Target
217cf1405a903b75972ef5c2b18f591dbe2b9dcb6b82c4d0347aca08ea940d4e.exe
-
Size
5.9MB
-
MD5
938c942ccd0d7db02a3d3af7a7a5509d
-
SHA1
a2dfead6ca5f3225020c2b4993205fa69de83c86
-
SHA256
217cf1405a903b75972ef5c2b18f591dbe2b9dcb6b82c4d0347aca08ea940d4e
-
SHA512
d5f64a9551e09a69b939988c339882064b8fc3a45c1f485425247fec8902b1a57a5eb084d8fe48cdf30783abb9c76e7c7439d5f8495866578b89d5c21bf76f17
-
SSDEEP
98304:tt8s4Q/1TIvlVNMNN6juVG2PtQz9AIqnvRGs/K5Y5DNimZBFQRzWZfEcWWMbhRwN:t7/1B7KWZ5PNimZ7QF1WEw3eUmY
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\217cf1405a903b75972ef5c2b18f591dbe2b9dcb6b82c4d0347aca08ea940d4e.exe"C:\Users\Admin\AppData\Local\Temp\217cf1405a903b75972ef5c2b18f591dbe2b9dcb6b82c4d0347aca08ea940d4e.exe"1⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx