Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
23-11-2022 18:24
General
-
Target
d8707e3d0ca32ee8c1aba3461b6b8c31f434f290710c358e4b32a863c7e6e6ef.exe
-
Size
1.3MB
-
MD5
0abc24cc54dc964e55ddd0eae907a832
-
SHA1
5c4a7446db001db68a0669e271ef521c983c0f66
-
SHA256
d8707e3d0ca32ee8c1aba3461b6b8c31f434f290710c358e4b32a863c7e6e6ef
-
SHA512
f13ab48c19a2411855355290c545859da5578ec6c6ec46c0506b503c1ba1e7b6f75085204eb839cdb030f20a066a693d20d6b46357b26a850e5a5525aab9da3d
-
SSDEEP
24576:2RmJkcoQricOIQxiZY1iahJklLJpHg+LS7rM7V5p6CdGiYteJ:TJZoQrbTFZY1iahepw8urgVx7Y6
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 34 IoCs
-
Suspicious use of SendNotifyMessage 34 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8707e3d0ca32ee8c1aba3461b6b8c31f434f290710c358e4b32a863c7e6e6ef.exe"C:\Users\Admin\AppData\Local\Temp\d8707e3d0ca32ee8c1aba3461b6b8c31f434f290710c358e4b32a863c7e6e6ef.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmon.exeC:\Windows\SysWOW64\ctfmon.exe2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 468 -p 4672 -ip 46721⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4672 -s 17681⤵
- Program crash