Analysis
-
max time kernel
155s -
max time network
168s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
01-04-2023 06:49
General
-
Target
Synpase/workspace/rostruct/cache/release_tags.json
-
Size
49B
-
MD5
feea89471bcab9da0f8a2fccf8ca5f1f
-
SHA1
ee892a04baaccfc6fa0a4d2c1d3ad54246a9a434
-
SHA256
43ecef4abfef9b2e4da7bb5d9bb51f28c09b299b0a831d555506af6ff5663db5
-
SHA512
c867a1de391cc5763b5aed30825f5380abe1db998668910707bffb77e38302626cb5215f15e1ef04aedc0458d1eb04f5b8f008c4e74efe29d5c7d7d934171cf7
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Synpase\workspace\rostruct\cache\release_tags.json1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx