Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
27/11/2022, 03:58
General
-
Target
5a30b0f54a189d21c8599dea7e58e3eacdcf5d6f6dd528fc61b359455e90fb0f.exe
-
Size
598KB
-
MD5
b775f8961b62823d702815d0a4ad03a5
-
SHA1
fd80aa88b1b834d9b4e10662ff96a3d5ece03c0b
-
SHA256
5a30b0f54a189d21c8599dea7e58e3eacdcf5d6f6dd528fc61b359455e90fb0f
-
SHA512
24cec17711961bea5ab00f50b109f6975f09f5aad8c2f39cfbf3069a62952dbb35cf47b370cde335d5eb9487b7ff5de30538e2123e373239d5bf5aebdb25a7fb
-
SSDEEP
12288:xQFagg7lePHhxOnqtsqB8asBqttBD1jSaDy5cAjqy5jRC8vn+D78FOW:xQFNgoPzJpB8asYt9R92KEa8f+0
Score
8/10
Malware Config
Signatures
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a30b0f54a189d21c8599dea7e58e3eacdcf5d6f6dd528fc61b359455e90fb0f.exe"C:\Users\Admin\AppData\Local\Temp\5a30b0f54a189d21c8599dea7e58e3eacdcf5d6f6dd528fc61b359455e90fb0f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
600KB
-
Filesize
1.2MB
-
Filesize
1.2MB