Analysis
-
max time kernel
24s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
24-11-2022 00:06
General
-
Target
470740db3adb6200fa19a8ce7d9c6b95254323a218871f9dfbf7c069f44f9b29.exe
-
Size
4.3MB
-
MD5
ff2795623e1fc2dc2d0885ff28ff134b
-
SHA1
a2b1af13ab785cd0083d768c5386fb6418cda13d
-
SHA256
470740db3adb6200fa19a8ce7d9c6b95254323a218871f9dfbf7c069f44f9b29
-
SHA512
647ac5c4d080a0a6eb2343607aa1c0be1f1eb293c39766faaa45a31643c288612a48912398a0822e6f8d4f7444d48579d4489aa213037375ef6b519c71507dde
-
SSDEEP
98304:o9MpHhvYzprr/vBHijXUMgBZwcU9hbkBjL2mGTO2+72AeqL//HP:9pHh2nnQpgBZwv9xSky2+77/HP
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\470740db3adb6200fa19a8ce7d9c6b95254323a218871f9dfbf7c069f44f9b29.exe"C:\Users\Admin\AppData\Local\Temp\470740db3adb6200fa19a8ce7d9c6b95254323a218871f9dfbf7c069f44f9b29.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB