Analysis
-
max time kernel
146s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07/12/2022, 00:26
General
-
Target
bf6fcc5619e4dc7f8442785d46210c8d33bfda8c036c0711c119866b81bc3188.exe
-
Size
234KB
-
MD5
b98db80f835d73e47bc9dc50fb98f9b9
-
SHA1
e816db709f0d065ca99a9fde60695f369be8f6c6
-
SHA256
bf6fcc5619e4dc7f8442785d46210c8d33bfda8c036c0711c119866b81bc3188
-
SHA512
19f2a49d27b01e2ea5cdb2e8693533718b7e16960a17a2c9bf40a3a0af848c9276cdbc6c97f73abcaa6356382642c0af81efb7d37851f28482fa25ce64e590de
-
SSDEEP
3072:uJm6SyNlF6C+ezX7eOfiGXmM6bxbdk6bFn9IqQxA1MAsfwQii+OckLhdinq9JAg+:Emw/+0X70vIJA1DhQL+OXL6q9ekmg
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf6fcc5619e4dc7f8442785d46210c8d33bfda8c036c0711c119866b81bc3188.exe"C:\Users\Admin\AppData\Local\Temp\bf6fcc5619e4dc7f8442785d46210c8d33bfda8c036c0711c119866b81bc3188.exe"1⤵
- Checks computer location settings