Analysis
-
max time kernel
206s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29/11/2022, 09:15 UTC
General
-
Target
9efe3735bf3d2d6f4d76f4474c2b17cb5fb199fdefb25a9e11ba2b1772cd7eb2.exe
-
Size
564KB
-
MD5
442236d6aa313bdd432f72e4cb82766d
-
SHA1
0fe215ad1c6d389d569b785ec30930fa3b666ac9
-
SHA256
9efe3735bf3d2d6f4d76f4474c2b17cb5fb199fdefb25a9e11ba2b1772cd7eb2
-
SHA512
db2f433d7682e2d88642be6cfce35abf0572abb10b946537a33506773adb8acea8ca3e0fec7a170b4f039c447303514052ec8598ccf76f39002dab5342dce261
-
SSDEEP
12288:/GQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAt://IdQ8KglrNYltim/GRJx8At
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9efe3735bf3d2d6f4d76f4474c2b17cb5fb199fdefb25a9e11ba2b1772cd7eb2.exe"C:\Users\Admin\AppData\Local\Temp\9efe3735bf3d2d6f4d76f4474c2b17cb5fb199fdefb25a9e11ba2b1772cd7eb2.exe"1⤵
- Suspicious use of FindShellTrayWindow
Network
-
DNS97.97.242.52.in-addr.arpaRemote address:8.8.8.8:53Request97.97.242.52.in-addr.arpaIN PTRResponse -
DNSf.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpaRemote address:8.8.8.8:53Requestf.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpaIN PTRResponse
-
20.189.173.11:443
-
8.238.111.126:80
-
104.80.225.205:443
-
40.126.32.136:443
-
40.126.32.136:443
-
96.16.53.148:80
-
96.16.53.148:80
-
8.8.8.8:5397.97.242.52.in-addr.arpadns
DNS Request
97.97.242.52.in-addr.arpa
-
8.8.8.8:53f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpadns
DNS Request
f.7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa