Analysis
-
max time kernel
91s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
17-11-2022 19:55
General
-
Target
AR37.iso
-
Size
970KB
-
MD5
3f430d80f682127c82644220ce17ebcd
-
SHA1
294f41577e9abaaf39c61d079ed407021d421eff
-
SHA256
b866e642c8167ffbeb5d55df5ea8bf2c5e565fd05242ed2a2934a6ca48745153
-
SHA512
a28e112be646337b3848da600823830c2d70e67749dd7402c35643f8af294ef333a2a85e0d50236a3349884dfaab1a3ed570ff8c24ce28f6fe552fc7d1bf9451
-
SSDEEP
12288:mon6F+DfZxL4+Dir8lkQ5z4hbAmKFX4GfOs5VBNYRbWAUWWvoYPiwBPhKwnONVvo:mon6F+DRt4Tr8lkBh8p2QOUDKw9
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\AR37.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken