Analysis
-
max time kernel
1s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31-12-2023 01:56
General
-
Target
6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe
-
Size
1.9MB
-
MD5
dd56ec4f23743414581e3e3b8bff5efa
-
SHA1
9852e771cc191380a02e65b3efa5ed2d0aa09c87
-
SHA256
6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af
-
SHA512
6c8f9f519a30ccf98f64967bf8e3c922fcf54a2d1f584b501907c0353e3cd1391253472b39b344948e61c7185bd793a145c034d71ecdb09e2668ca85a355a0e0
-
SSDEEP
49152:MUOD1KJg/zjrYNjlCnhSYgZE8Xsh050F3Vsb5EX1QxoYiXYiOmPy:MUODawfYoYf
Score
4/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe"C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af64.exeC:\Users\Admin\AppData\Local\Temp\6f084bfc9e26773a7d8f6c59b3650f7307a7b725fd2e9fddcba2199c28a349af.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Notepad.exeNotepad.exe C:\Users\Admin\Desktop\Rkill.txt3⤵
- Opens file in notepad (likely ransom note)
-
-