Analysis
-
max time kernel
236s -
max time network
259s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06-12-2022 17:29
General
-
Target
f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6.exe
-
Size
633KB
-
MD5
1894979035c3f3c277d56af60634f27a
-
SHA1
b79244e6b3409850ae13fe2a436cab5cb13ae300
-
SHA256
f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6
-
SHA512
18a28c8f5e5c4eddabcf61b8baaca00eb076a2188eaf41e110198a4b05464a181c7f954461b81e1a4cc4fdbcf8a791b1c2ab3bddeaf20fdeefb4f6555191c06b
-
SSDEEP
12288:Dmz9D59BmQ6oK4Irm/OtKafiiEdabltpVCkxOJMSYlCc6QcRLh9NZU0j:Kz9D590Rogrm/OB4UltngMTgDQcRLP
Score
8/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6.exe"C:\Users\Admin\AppData\Local\Temp\f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6.exe"1⤵
- Checks computer location settings
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
-
Filesize
60KB