Analysis
-
max time kernel
211s -
max time network
236s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:34
Static task
static1
Behavioral task
behavioral1
Sample
f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.exe
Resource
win10v2004-20221111-en
General
-
Target
f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.exe
-
Size
36KB
-
MD5
58f7512f66090c82b83fbeb45ed5bf7e
-
SHA1
05661bc15888829f40e829558e21abf50434f5a8
-
SHA256
f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818
-
SHA512
bc902c54956e858696385e4f36190ec413d325db8ee134e43a3af2e389aa8c9f14189d8fe4868dd04937927ecfec68e46ef588ed8f84800227ca831f6cc8fec8
-
SSDEEP
384:phca+ovhI/f921ce+wmPvB1KrjUHqj0GjZdndd6+lPc5gTc25xU7aUETjEKLrY32:piaRZI/fjP52fbf/GZETRLG
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.lnk f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.exepid process 3196 f5b1c65b448e83e7a0a305cd9554ee44094b470e890a1e7c526a4695a52e0818.exe