Analysis
-
max time kernel
14s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/11/2022, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
SUMo.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
SUMo.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
SUMo.exe
-
Size
2.1MB
-
MD5
6249bcbb6eadb5dff57169800888cebf
-
SHA1
6ece54869b148da98b33b2970ea0e1fce8203217
-
SHA256
c42634ea616b933a85fa9654986a4647480de821d609561e4fc3f7449931e2c0
-
SHA512
0da0ca616f5c0d6ce93d35563a9c8530b9681abc0483787426fe9fcb895365aef6464a41c464b93a565464a439bcc422c1778fcbf9ade3a2ed636f9229a20c47
-
SSDEEP
24576:yAWNX5L4TLN3vEdPqIR0MfiWotrI8FiUQtLKB6KNnv2M5aIvufnXuSkkBwNW+piC:yA1hKjRYpX+juv2M598eSkkBwrJ
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 240 SUMo.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe 240 SUMo.exe