Analysis
-
max time kernel
152s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 11:37
Static task
static1
Behavioral task
behavioral1
Sample
5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe
Resource
win7-20220901-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe
-
Size
3KB
-
MD5
0165dbe56f68447a332efdba54a43280
-
SHA1
1849fea255a40009662be473871e26fe4bf70318
-
SHA256
5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741
-
SHA512
9da8adf68f8cd9c10bdd087d4f9803e7701a8f6b27da66e2790097ce1865d9858233509152a6bf6b517733cd64226c1c2f742b8906ecc869577c7988b11df553
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2808 5d0cbfc8df07850b8afbc7170a1f0b15327ce8da9379891510fd5970ddf4e741.exe