b3f78a3f3823808cf3622128fe076552fb8bbdbedad1fe60607ab6f9981697f4

Analysis

Target
9074f8806ebcff10cfb69e1e66caafc5.exe
Size 5.2MB
Sample210225-a8prbkadan
SHA256 b3f78a3f3823808cf3622128fe076552fb8bbdbedad1fe60607ab6f9981697f4
MD5 9074f8806ebcff10cfb69e1e66caafc5
SHA1 4afdcd05300735d0b23d7bf0068f98dc71a3d59b
SHA512 0b32af8dcc8212ca11702bb13b05af9ed5035a88d2ec7df66646b5ce181368ac677d34c5e3ffe287e21aa082336eb7743901351e7decb5f23db2002e75d466c7
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1932	9074f8806ebcff10cfb69e1e66caafc5.exe

C:\Users\Admin\AppData\Local\Temp\9074f8806ebcff10cfb69e1e66caafc5.exe
"C:\Users\Admin\AppData\Local\Temp\9074f8806ebcff10cfb69e1e66caafc5.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1932-2-0x00000000750C1000-0x00000000750C3000-memory.dmp

Download