Analysis
-
max time kernel
62s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
28-12-2022 06:29
General
-
Target
Princess.Conquest.rar
-
Size
882.7MB
-
MD5
f6001824c7684a240c13bd1b802e8b6e
-
SHA1
1602f29a4b3c5a99ac9e2cce16dfe59936e32678
-
SHA256
f34c3b62fabb53ec10d4b0174eeb662bfda5d5a7dab84661f1acd94e40b101b2
-
SHA512
345deae4764aa599618d5b38720dc44ca373b4fd01aefe6df8f49cec2abfc077703b312b26699e97bdbcff230f56d06419a40c9288810e2a00767e49eb61c4bd
-
SSDEEP
25165824:lDnJTuVlmKHPgUUMVF5FEc29VypLmEY1Wa:5JFKv9nvfMLypLmEY1Wa
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Princess.Conquest.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx