Analysis
-
max time kernel
92s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
02-03-2024 15:33
General
-
Target
SAMP/SAMPCOL.img
-
Size
3.2MB
-
MD5
eb690e98b644fa584be6917d48ee6cbc
-
SHA1
cf5ec69bc0725c3b6b55c5934bfecac971060572
-
SHA256
aa6dabfb4b38e3b79949bbb3aa4f90c7e4fd3909feed37335b2d656e73089490
-
SHA512
e3a2892e2aede8dbc60ef0c76f9be854c54f5984bc3600ba050ce2f1c81be22e4e17817b83cc396e5ce2d004b074ef9343a9b85f30bb28dfc434def0a7c1fd01
-
SSDEEP
49152:FHL7Uy8oZ3bRaNg8GvPYH0EYLz+rxGg333hfLi:RMyNZLRay8GvPYH0EYLz+rxJdm
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SAMP\SAMPCOL.img1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken