Analysis
-
max time kernel
89s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
25-01-2023 10:38
General
-
Target
mats.img
-
Size
66.4MB
-
MD5
707db4d641a2bb3e14bb91327b75ee87
-
SHA1
acf77d5cffa8ebce597f80ca4c9b01b351352c3b
-
SHA256
eac96ab9a056461c4560066936c8af173d17d18ac8af68e373fc07d73244e8dc
-
SHA512
b27648968a389059af9cb3749c56dbd9a0c5234b44621d063cfde948eeaf9550cd9e89c4b7aa971427d6508efb8aecb3e8e6f7b5cc8a16b008d6c8e83382b9f5
-
SSDEEP
1572864:3YmMX2KKYtxefLs1FZ9bE4P8+2t8qL70SmO:IRX2KttHX4
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\mats.img1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken