Analysis
-
max time kernel
160s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07/11/2022, 08:00
General
-
Target
ab9e8a669ee322a4795278e3789eae425fa797ae037a45fb3e320c20363979a0.exe
-
Size
191KB
-
MD5
6c1e1573a9b76d150a481497323abc53
-
SHA1
48981050f022281bef8b59e38f1eacc1f9ce0126
-
SHA256
ab9e8a669ee322a4795278e3789eae425fa797ae037a45fb3e320c20363979a0
-
SHA512
5b5c81e37e6e0dc881a5963d236398b98303577070e74db5bd15206222c0d80b648ef9b54d6deb9c9d000f682a513bfa6a7f79c30a167ca529e6e08123b81070
-
SSDEEP
3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0dU:HAVySV1eY4k437d+4wkTHdS2s
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab9e8a669ee322a4795278e3789eae425fa797ae037a45fb3e320c20363979a0.exe"C:\Users\Admin\AppData\Local\Temp\ab9e8a669ee322a4795278e3789eae425fa797ae037a45fb3e320c20363979a0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx