Analysis
-
max time kernel
90s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2022, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
85324ad7ed8aabb87fa247876dfe465dbb8fe6b2f02e254d3aab81977af4e159.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
85324ad7ed8aabb87fa247876dfe465dbb8fe6b2f02e254d3aab81977af4e159.exe
Resource
win10v2004-20220901-en
General
-
Target
85324ad7ed8aabb87fa247876dfe465dbb8fe6b2f02e254d3aab81977af4e159.exe
-
Size
3.4MB
-
MD5
63b99a85473b1b35bdd51e9dce8084d3
-
SHA1
6f358aa3950ffb0fed77759315455e3205e669e0
-
SHA256
85324ad7ed8aabb87fa247876dfe465dbb8fe6b2f02e254d3aab81977af4e159
-
SHA512
d52ba98e164796b6c4533426a84804463190a1ca9d85582b92311d0f75bbdc9fe7669cc253282ec5246a6377aa8145b0138200b978e263e307bc76a641007ae9
-
SSDEEP
49152:uyJSePQELOpiwE5uaZwps6Q2vE0C2pDL3acT1ba1X:uLePQiwEQ5s6L/FVHbs
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3224 85324ad7ed8aabb87fa247876dfe465dbb8fe6b2f02e254d3aab81977af4e159.exe