Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 09:42
General
-
Target
75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe
-
Size
1.3MB
-
MD5
17ed41a75f0dae4963ed3638260dfca7
-
SHA1
2306fd5d79a8c2c99b99ff658c9137c0f949e73e
-
SHA256
75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad
-
SHA512
8227ead98474e8aff1022b24147968d34558ed920026b987af580addd3e66604b7cd19555d16a7e2cb5c73259721829299f2a3d7c9438ab93b3d7b7cb0d57298
-
SSDEEP
12288:S0/dP4yWOmaHOk30CbQqO8ThGkQai+5sy4kB/S:S8wk739skQai+G7oS
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe"C:\Users\Admin\AppData\Local\Temp\75002ded743cdc3321c79d31ec513715a0948737fbdb2f31e9be026fe31a45ad.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
584KB
-
Filesize
5.6MB