Analysis
-
max time kernel
184s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
04/12/2022, 04:48
General
-
Target
b00da5f08aaf5a05956566d88e99ecb3bfe2e3a760a6f0cec561d5ed0ac1ddee.exe
-
Size
191KB
-
MD5
8baeb1e316d3d8e33f43b88b52720d7e
-
SHA1
8ed769a038e6e7da8b3c5a586c0705d0770e5008
-
SHA256
b00da5f08aaf5a05956566d88e99ecb3bfe2e3a760a6f0cec561d5ed0ac1ddee
-
SHA512
7168e0d954d5a1ca3ad5cae0325113e1fead5c3c63ae61a3463cb9f813b3f65a6ecef9e30bf27bc84ba9985e9e6739657bd36a54f7bd407de37b850c417b5ce8
-
SSDEEP
3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0dJ:HAVySV1eY4k437d+4wkTHdS2B
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b00da5f08aaf5a05956566d88e99ecb3bfe2e3a760a6f0cec561d5ed0ac1ddee.exe"C:\Users\Admin\AppData\Local\Temp\b00da5f08aaf5a05956566d88e99ecb3bfe2e3a760a6f0cec561d5ed0ac1ddee.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx