Analysis
-
max time kernel
111s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
15-01-2023 18:14
General
-
Target
24fb2a043934cdbefaa41240d2ff941abc3b9d7c60745ce8a8d5bcfce2e26bb9.exe
-
Size
2.4MB
-
MD5
9e818c2e6028c5ef9eb1bec389e9ed95
-
SHA1
acb4d4963355d4a9a27bb33ca5d770c875ca65dc
-
SHA256
24fb2a043934cdbefaa41240d2ff941abc3b9d7c60745ce8a8d5bcfce2e26bb9
-
SHA512
c68775c94456e82bdc4204dd07cecd65bcbde8fcac101a09d653f5fc0c2d1eac1bfc4b48cb4df4a01a1f0e345268af28751a04705c266a05092009695334fc16
-
SSDEEP
49152:m4GaJkD7EJZ5Ko990VtGZO8mAvjIkNDx5GO:dGkkD7EJZv0VteOjAEsDjGO
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\24fb2a043934cdbefaa41240d2ff941abc3b9d7c60745ce8a8d5bcfce2e26bb9.exe"C:\Users\Admin\AppData\Local\Temp\24fb2a043934cdbefaa41240d2ff941abc3b9d7c60745ce8a8d5bcfce2e26bb9.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx