Analysis
-
max time kernel
81s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
27/11/2022, 16:39
General
-
Target
15c8aeec1a46395cf2ca1cfab0c83330ee9d4771b433daf07fb9e09d86d81bbb.exe
-
Size
350KB
-
MD5
850e5bb4c69262e0b0ecad23580e5488
-
SHA1
a00ee64af8c6480028ced8928432209a25103db3
-
SHA256
15c8aeec1a46395cf2ca1cfab0c83330ee9d4771b433daf07fb9e09d86d81bbb
-
SHA512
472eb441ebaecf63fca3bc06e15a09d949ecbd05b9bbe649ce8f47a9c66fbeced632eb73cd11b243bd1671999beb7c2edb99112afdd7cb8dd6075a8c1fe1819c
-
SSDEEP
6144:UilnLSK9gx2U26ivpCB/iMwFfvSasmuF7wrQ66iOQWbyu:xnLHAr+pCZiPaasm8P661l3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c8aeec1a46395cf2ca1cfab0c83330ee9d4771b433daf07fb9e09d86d81bbb.exe"C:\Users\Admin\AppData\Local\Temp\15c8aeec1a46395cf2ca1cfab0c83330ee9d4771b433daf07fb9e09d86d81bbb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\notepad.exeC:\Windows\temp\notepad.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB