Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
16/03/2023, 13:43
General
-
Target
6.iso
-
Size
452KB
-
MD5
7facd87cedadc1c712112077b726d937
-
SHA1
4ad1261ec05a7184e9887ae186b72e1f8d45e49f
-
SHA256
4367007de8752a8e735f3092d0d574fe120ab6205b28a0ba3b125cd2ba906be7
-
SHA512
b0105466cc3eb3b8530b6a661630b10997bdfe14d5976c6281b2eb43368d9b506bcd68dd4b1bf3e9ccee0cf60c4091d63cd67d02b2759fdc73640c56dd01f644
-
SSDEEP
6144:BZm442EzPa3Ym+ue9hYfB/1R+Z0o79GYAy2eISP6WZREgK9:BM2ui3Y3hYBPuPcpyPISPrIgK9
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\6.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken