Analysis
-
max time kernel
91s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20/12/2022, 16:42
General
-
Target
DocumentsFolder 3873059 12202022.img
-
Size
2.3MB
-
MD5
13bc706af9469f03b01f9663d2ce51cf
-
SHA1
90a4459a08a205b54644b5fa65772ef8a5ec618d
-
SHA256
ff37040a9117e4c0adb718ebc9570de6e2630aa45d76cbaa46a4997837fe6f52
-
SHA512
e8919f1914dabda79043487eec5180bd178f8fba1aece891f020df7d8a97aa5b942a3bae9d86b5dd5b1730b472d3d87260d6191f253bb746d934e9d65bb8c140
-
SSDEEP
24576:lKbbqQlRH90zhBs7tl+vJtzsJPwfwXR1F0yvc8NTmIg9EcjZdFkz:lKXqQz901gcDsJPwfwXfFxvFnQ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\DocumentsFolder 3873059 12202022.img"1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken