Analysis
-
max time kernel
202s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29-11-2022 07:05
General
-
Target
0c9efe369d3e501177fe4876a7de0a21.exe
-
Size
843KB
-
MD5
0c9efe369d3e501177fe4876a7de0a21
-
SHA1
c248810526f7c2fb017531963404d2ddede89290
-
SHA256
104d9edec97eb16b20380e92ec10a7dff27e64de1ff2d8eefa764a4aa8648242
-
SHA512
9b7189a09636e8ba519bac137b21664ac2abd650336dd570ba4f4d6e66e67f98a586c3013de9df57705cdeef04c5c115340bd3a812e6c59aed7fc5764062a842
-
SSDEEP
24576:DaGph/ows0HAjiWMN1j/cRNY9wrgwNuJOF:bOwBHuO1LqN380u8F
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c9efe369d3e501177fe4876a7de0a21.exe"C:\Users\Admin\AppData\Local\Temp\0c9efe369d3e501177fe4876a7de0a21.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
812KB
-
Filesize
812KB