Analysis
-
max time kernel
188s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
04/12/2022, 08:11
General
-
Target
afb8d4dee2917ed90a1770157267eee162a1b38f51636af915dc473e31bc6355.exe
-
Size
191KB
-
MD5
769724234035c6cdf7ace98af7458651
-
SHA1
499ea0876e25a5bcbb7c91a85fd02e258b9a954a
-
SHA256
afb8d4dee2917ed90a1770157267eee162a1b38f51636af915dc473e31bc6355
-
SHA512
53eaf444e69eb7e95eab62eef7a9b984ac09f9ca0b46445f13a85c0b662fbda869dc68aeaf4a35df1a5f707eff4f898af2bf5faf6414e9fa73e39970f3c269bb
-
SSDEEP
3072:HADWbKzKbQmSVdSme+xmJyD4BliqzsmmEpEmboQd+ccewkyeZyYPuvGCJ30EZ0d4:HAVySV1eY4k437d+4wkTHdS2w
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\afb8d4dee2917ed90a1770157267eee162a1b38f51636af915dc473e31bc6355.exe"C:\Users\Admin\AppData\Local\Temp\afb8d4dee2917ed90a1770157267eee162a1b38f51636af915dc473e31bc6355.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx