Analysis
-
max time kernel
79s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
24/03/2023, 15:54
General
-
Target
Adobe PS CS6.rar
-
Size
73.7MB
-
MD5
29ad271054dc7a7fcfb691ac9515ab3b
-
SHA1
96e9489824c0944188d48384efb7d0d4ac74eaeb
-
SHA256
6f2826909d7cc11f2c297cae935a606c36bef1758d191d06deb82a6cd7600d0e
-
SHA512
259598be80d8634dd8fafcda7c81c3ae605ea510dfd8259df63db097bab606adfd7dd3c72e8479ff7731fdc1af78312cfe31d82e41db3965ffe6740a04f068ef
-
SSDEEP
1572864:JKT3GWkokgm1Pia0dgTqHXwTvQ6GH0FBEJNJ5TOLOx7fSTtjIvmEx4:JKTWWMia0mDAUrEzvOG6T2e+4
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 37 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Adobe PS CS6.rar"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵