Analysis
-
max time kernel
147s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 06:52
General
-
Target
21f6fd4a547b2901a1234c2f44bb16fd86000d3f2195f1d47e0bcd53dd626829.exe
-
Size
1.6MB
-
MD5
2ca72a6bf13cc2f1527ee748edef2036
-
SHA1
c1da1d62a7fb6f186c137164dd72826262ed7f6f
-
SHA256
21f6fd4a547b2901a1234c2f44bb16fd86000d3f2195f1d47e0bcd53dd626829
-
SHA512
6db2f2fe34dd2e28c247b94bcf78366712e3b4382ad62fe9c93265b20a0d291a55a6f742797a02f3a8d6feb8d3421d967749bc6f2bcda3e6e74518a958cda110
-
SSDEEP
24576:kRmJkqoQrilOIQ+yMxGaQHWaA1VjT0xp0scjHQCIE4UQ7aiTedf:VJXoQryTiMxGaQ2aigCHnI15eiTeR
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f6fd4a547b2901a1234c2f44bb16fd86000d3f2195f1d47e0bcd53dd626829.exe"C:\Users\Admin\AppData\Local\Temp\21f6fd4a547b2901a1234c2f44bb16fd86000d3f2195f1d47e0bcd53dd626829.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage