Analysis
-
max time kernel
258s -
max time network
261s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
09-01-2023 05:18
General
-
Target
SCAN_DT6281.iso
-
Size
1.0MB
-
MD5
accaf498cc18b4e3fd81e5a14cf33ed1
-
SHA1
93c6347ac71baa517540ba49a38172d68cd625d7
-
SHA256
cc1fdbde529da88eeab58ff1695c80d2be68df600024860b3b9622c8a312affa
-
SHA512
ffa919c222dbb8b3377870bc9665a2fd35061bfbb05adcd0e3dfc38c6b41757989414fed835864661605180a6268765b8e1cf0d076af1b49a766c1e37bba29d8
-
SSDEEP
12288:9YokNyxh/QFYZLlW0qSQ8qVC6od45xk2SCWisesV:2dEvoFkRkS/qI6odz2vWiuV
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SCAN_DT6281.iso1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken