Analysis
-
max time kernel
378s -
max time network
431s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26/11/2022, 23:56
General
-
Target
CF小辉[官服]多功能变态辅助V1.4.exe
-
Size
1.9MB
-
MD5
01c593e379f2c0c1ddffdc96b2e4a4bf
-
SHA1
0aeba0e32ba0adac55e6707ac06e72a493da218f
-
SHA256
12aa1b0c015d3802e3ba7c6946c5abde174027cf5ada77f54f59c508eeacef14
-
SHA512
7bc548e4729b5d4c6fb92944884b42fa6022aab30db02bc5137374327878661ec316d0696afdff5ca1a0048131c75dc76e96094d82e840b68a0437355fb845e3
-
SSDEEP
24576:BI6iRjMaoeVxOCnPd/b/cbphbf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLYg:ByxM0/1YNJ+s8KuqGaX0ToIBAUZLYg
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CF小辉[官服]多功能变态辅助V1.4.exe"C:\Users\Admin\AppData\Local\Temp\CF小辉[官服]多功能变态辅助V1.4.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx