Analysis
-
max time kernel
162s -
max time network
203s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
24-11-2022 00:06
General
-
Target
5c5cb3316c7db941c05792247c6baed999ba2e60584cb8bc8f96abb34dad0bbe.exe
-
Size
4.3MB
-
MD5
e42f0e36fc3d49acdcfd536870206b05
-
SHA1
fe7cc41084d48ee59919efa22b6499884dc74923
-
SHA256
5c5cb3316c7db941c05792247c6baed999ba2e60584cb8bc8f96abb34dad0bbe
-
SHA512
50b9e164da39e340cc0e4b8ddcb865e931def161b8ca2338f45b0fcdb5f053cb5277fbceaa621e53b2a5154220419b4dc9339c10562ddb7a81bb1d2607c8a7fa
-
SSDEEP
98304:o9MpHhvYzprr/vBHijXUMgBZwcU9hbkBjL2mGTO2+72AeqL//Hs:9pHh2nnQpgBZwv9xSky2+77/Hs
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c5cb3316c7db941c05792247c6baed999ba2e60584cb8bc8f96abb34dad0bbe.exe"C:\Users\Admin\AppData\Local\Temp\5c5cb3316c7db941c05792247c6baed999ba2e60584cb8bc8f96abb34dad0bbe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken