Analysis
-
max time kernel
151s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2022, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe
Resource
win7-20221111-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe
-
Size
3KB
-
MD5
46bfbd11e27977a087293bb14fc8fef0
-
SHA1
460b2ab4b660ccbea720862e0f47f7400b207368
-
SHA256
b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c
-
SHA512
e1f8cabc369c98699bdb0ea07113f0ce23bd293024b1fb36b3b6c95373997ff250416d9ec6f0ba7409c0109a14d12632b79038c0abf9b1ab4259850c5fae8d32
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1912 b395ade209f9d9f0e848fa3ad82b6f2009b7cb36c82b7d2957d80674a267e22c.exe