Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
28/11/2022, 03:47
General
-
Target
9a57eba90f732b60abfe85a906866efc2fd102cfe65df0d17a90e895dcbf0f9b.exe
-
Size
4.9MB
-
MD5
4be7c60b46fcc33a7a1c158007c42f65
-
SHA1
4cca6ec966b565085b8d7e82cb711e579d590429
-
SHA256
9a57eba90f732b60abfe85a906866efc2fd102cfe65df0d17a90e895dcbf0f9b
-
SHA512
7c54c426767230d2459f541e2858699d5cd738f6ba38692329d3269be464ee3fa9b78322e0d1e757048868f0421522800a25cc7cbfb32acd34b74c481a74836d
-
SSDEEP
49152:yxQKiS8ymnOV7BT5qmnFC6RKSBj61/cdGjbpVnTiQuXb0D70PLsmFYQMSGI6iyim:y6nOVLc/cdGxH0PLpFY1iyi1EMFBHk
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9a57eba90f732b60abfe85a906866efc2fd102cfe65df0d17a90e895dcbf0f9b.exe"C:\Users\Admin\AppData\Local\Temp\9a57eba90f732b60abfe85a906866efc2fd102cfe65df0d17a90e895dcbf0f9b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-