Analysis
-
max time kernel
151s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25/11/2022, 18:28
General
-
Target
0bcfc18ea1689045bafca78e8e28fd8320223735764b36b8fe7fcd7e0380fc15.exe
-
Size
688KB
-
MD5
99e2960fa4f4e23267ef280e14ec2ab3
-
SHA1
53f2f46a578bf3e15d77982b8a3386c4fabd1b80
-
SHA256
0bcfc18ea1689045bafca78e8e28fd8320223735764b36b8fe7fcd7e0380fc15
-
SHA512
e7180b5175545ab129c5f36e9381db801056af515c2a7f9c1c5ca78804f13563f52bdaf9abf2ce15d45543efe99e146b0c8b0779177691aa5c10128acf10a526
-
SSDEEP
12288:WnvpS1w3sPVESMn/QLPNPjQ6XlsZwOcmxwaxIxVdWYRJJJkXu19TDbJ:WnvUq3sdW/qjQ6X5OlwaxInddLkunPb
Score
8/10
Malware Config
Signatures
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bcfc18ea1689045bafca78e8e28fd8320223735764b36b8fe7fcd7e0380fc15.exe"C:\Users\Admin\AppData\Local\Temp\0bcfc18ea1689045bafca78e8e28fd8320223735764b36b8fe7fcd7e0380fc15.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
692KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB