Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 16:21
Static task
static1
Behavioral task
behavioral1
Sample
c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe
-
Size
3KB
-
MD5
1aebebad84af946ccd827d5a07c1e5f0
-
SHA1
8f3e806e63f2a69706ff5657db9db7af0c99abfc
-
SHA256
c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da
-
SHA512
ea1594967a5f5fd938aba5b64eed00894e497ca66ab45a69fe6f4af91aa18a12ed5e6a8e63eadb668e704a934cab05a02a6ac62d1f301295db4d04ef66d6b1b1
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1280 c2e29409f490d68b221535d8bc1cf0cbdc3521331fc9204b419e7f0a2b0b64da.exe