Analysis
-
max time kernel
134s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25/11/2022, 23:15
General
-
Target
Nf.Eletronica.330253384933059.pdfread.exe
-
Size
24KB
-
MD5
4ac8bd6f750e40eb1fc583cee671b7ea
-
SHA1
fba4af2150bcd0f660d6507f7a9ceda4ce9c6f46
-
SHA256
889d6cbec6febbd5b0c4fe57de0d22cfb8089412b95183886f577206cf3d854a
-
SHA512
3da6d1e92c4156ccbd2ee7d3ef71a2cf8d7f492f248a38ed4217682d542b28530ea69c1a7ff77f9d8c3e1761ec362845ca818b4335e967d9e07f835d18e021cc
-
SSDEEP
192:/TIq6h88sIj4TiikebzIsrYaA/ztOKWtSFJA0s/0E:/T+88sbOike3IfueJA0s8E
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nf.Eletronica.330253384933059.pdfread.exe"C:\Users\Admin\AppData\Local\Temp\Nf.Eletronica.330253384933059.pdfread.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx