Analysis
-
max time kernel
44s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-11-2022 00:03
General
-
Target
2bc4b3921cc6438f5b352e26373a987656ed9cab4557f33ef10df408c64a1ccd.exe
-
Size
4.3MB
-
MD5
3c6f87199eeab27edd31aafcf4c0f5a9
-
SHA1
10ab5ad92f8b6f929d85437bbcbe9c4dd3f7747c
-
SHA256
2bc4b3921cc6438f5b352e26373a987656ed9cab4557f33ef10df408c64a1ccd
-
SHA512
ccc971cbaa0c708cbc1d577c06c8126857046ba8501624893afeb0879003b3c396d7d2bfbaf2baffd61a02ca2c498f1455b6c4f0d18865483d6997b48f226c55
-
SSDEEP
98304:o9MpHhvYzprr/vBHijXUMgBZwcU9hbkBjL2mGTO2+72AeqL//HW:9pHh2nnQpgBZwv9xSky2+77/HW
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bc4b3921cc6438f5b352e26373a987656ed9cab4557f33ef10df408c64a1ccd.exe"C:\Users\Admin\AppData\Local\Temp\2bc4b3921cc6438f5b352e26373a987656ed9cab4557f33ef10df408c64a1ccd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB