Analysis
-
max time kernel
90s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2022 23:28
Static task
static1
Behavioral task
behavioral1
Sample
ID37.iso
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ID37.iso
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
WW.js
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
WW.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
animators/partisan.dll
Resource
win7-20220812-en
General
-
Target
ID37.iso
-
Size
970KB
-
MD5
ce217cdd7c22441a909229797783c29b
-
SHA1
1a38d960944c47023904553e1a19c606cf8dab43
-
SHA256
adf34d14038038ba873c7a682b81fdea8bfee750bb79baff418395eff1f43dd8
-
SHA512
0336d1f57b4879bf964a5c1174768c303d498610dd7fa99d4974dc0b1d9bda898b8bc09a02805cded8504dcc6b8e03724ada76fdb448b4b518787969b2a837ae
-
SSDEEP
12288:jouKwnON76F+DfZxL4+Dir8lkQ5z4hbimKFX4GfOs5VBNYRbWAUWWvoYPiwBP2vo:jouKwW6F+DRt4Tr8lkBhOp2QOUZ
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
cmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cmd.exedescription pid process Token: SeManageVolumePrivilege 1360 cmd.exe Token: SeManageVolumePrivilege 1360 cmd.exe