Analysis
-
max time kernel
202s -
max time network
218s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
27/11/2022, 07:34
General
-
Target
YYHeZi1.0.9.1985/Flower/flower.exe
-
Size
951KB
-
MD5
31d58b424aaedf3e678fbbc4b9a9114e
-
SHA1
d4e79a92608089be1591fd1e75b7dd239ab2b3e8
-
SHA256
e8441060e3320ae2d633ac507201faf6060fb7c1cdd96a24a61b27e35a5722f0
-
SHA512
57b816f95f6bb90d8857dab57ea351b2fbb2ce587750195ed4acf77d7614d6532bbfb00a1a610c2883db88917750f0b58bc715fbec5c37715e7508a0a30b6d45
-
SSDEEP
24576:/Vebh8G8p957r+BimrojOnAOKqnj/MHnFLz/G1x:U+uMyoyLDnoHFH/Gf
Score
8/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\YYHeZi1.0.9.1985\Flower\flower.exe"C:\Users\Admin\AppData\Local\Temp\YYHeZi1.0.9.1985\Flower\flower.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
-
Filesize
2.8MB