Analysis
-
max time kernel
16s -
max time network
15s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2023 13:18
Static task
static1
Behavioral task
behavioral1
Sample
dControl.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
dControl.exe
-
Size
763KB
-
MD5
0a50081a6cd37aea0945c91de91c5d97
-
SHA1
755309c6d9fa4cd13b6c867cde01cc1e0d415d00
-
SHA256
6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b
-
SHA512
f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846
-
SSDEEP
12288:baWzgMg7v3qnCiOErQohh0F49CJ8lnyzQpJ2KNP3A8wnqqF:uaHMv6Carj1nyzQpJ2KNPw/
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1356 dControl.exe 1356 dControl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1356 dControl.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe 1356 dControl.exe