Analysis
-
max time kernel
141s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 03:39
Static task
static1
Behavioral task
behavioral1
Sample
SSD-Z.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
SSD-Z.exe
Resource
win10v2004-20230220-en
General
-
Target
SSD-Z.exe
-
Size
1022KB
-
MD5
dc6e1b46c89572020133463ec43ca414
-
SHA1
f35b51f193c40570df9d5cef0d52637c6dd38898
-
SHA256
74a0850369ba9ffcbdeeb6bd087a4de1105055d2338378b83e79a91b3e2a5db0
-
SHA512
58161946051e94af4afba2f12ffadd3c3ec60f2f329a48f20970e31b17c4b358e6ccd87bb39f68b41c3159e99b9e16b395b53e18b39b734adbaccc5c5b9fc2a2
-
SSDEEP
12288:D71gfd+H6mAn3HMHQKOfmv4SBZaRtkuyQrioUaDBfLSpQOhygGyBjPVP+PVPXP04:X1gfdIAiHOfgDaRt/HeoUaDBfLoxcjy
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
SSD-Z.exedescription ioc process File opened for modification \??\PhysicalDrive0 SSD-Z.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.