Analysis
-
max time kernel
43s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
23-11-2022 20:35
General
-
Target
0aa3ceb461c416a9f560ff8fcaa6547e94ca8a392f50c82fd52ee84f14cf9a0d.exe
-
Size
2.7MB
-
MD5
e686f4f4c923ccbe7b9a90e225ee6f75
-
SHA1
b70cb0c93aea59e85c87fea11ccc124f2012079e
-
SHA256
0aa3ceb461c416a9f560ff8fcaa6547e94ca8a392f50c82fd52ee84f14cf9a0d
-
SHA512
9e6d0c828ee49a02226b625e7b4b847fb4cf1d569617dc917185a2068059d55f33fba79719052bbd82545b4e753a372fb8e34c7df0e9e90128ad920020ab2620
-
SSDEEP
49152:GEmq6hMhvevTNwyfMVnDwGJ+s8KuqGaX0ToIBAUZLY4:uMVevRVfNGiJBAUZLz
Malware Config
Signatures
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aa3ceb461c416a9f560ff8fcaa6547e94ca8a392f50c82fd52ee84f14cf9a0d.exe"C:\Users\Admin\AppData\Local\Temp\0aa3ceb461c416a9f560ff8fcaa6547e94ca8a392f50c82fd52ee84f14cf9a0d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB