Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 09:42
General
-
Target
26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe
-
Size
1.3MB
-
MD5
e33ee7f396945884e2647d1e039605a5
-
SHA1
73b8e72b1b6eb7f63de5918ee4a6994bd60b6d57
-
SHA256
26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077
-
SHA512
b48ee4ebbc3ce514913caec218edc93fefcd454fa86b9b18f820b6e1f1512d275dccf89f9998f8e2a1969843db8d6b4e6d06088e15c8d8aec1297b5d79b8c98f
-
SSDEEP
12288:S0/dP4yWOmaHOk30CbQqO8ThGkQai+5sy4kB/e:S8wk739skQai+G7oe
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe"C:\Users\Admin\AppData\Local\Temp\26974d9056a2805d9d26b04aeaa5a8570a1393af6986f7d13be89eeeaa464077.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
-
Filesize
584KB
-
Filesize
5.6MB