Analysis
-
max time kernel
147s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 10:45
General
-
Target
76e2ddb43c4fa3c264e2d38ab4329f919b98ceb7cf2eb9cf7a95dc24ffe8d77e.exe
-
Size
1.3MB
-
MD5
500c9c91cbe83e2355ff8efaa3ae3d04
-
SHA1
e443b933412631795dcf926fb4bda6293999e577
-
SHA256
76e2ddb43c4fa3c264e2d38ab4329f919b98ceb7cf2eb9cf7a95dc24ffe8d77e
-
SHA512
1163a380bacb96711797569dd7d7d9c8ede7c3c531b9ff9ed16d4c1e02210ccd1b2b465f2ce764f41c419082d4cc286eac70ed962f63f369419d85885c31ef83
-
SSDEEP
24576:W4lavt0LkLL9IMixoEgeasrWufpq6iyx2lC+ur3eDl7uWq9MmCS:hkwkn9IMHeasr3fpq9yx5Y7faPCS
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 32 IoCs
-
Suspicious use of SendNotifyMessage 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76e2ddb43c4fa3c264e2d38ab4329f919b98ceb7cf2eb9cf7a95dc24ffe8d77e.exe"C:\Users\Admin\AppData\Local\Temp\76e2ddb43c4fa3c264e2d38ab4329f919b98ceb7cf2eb9cf7a95dc24ffe8d77e.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage