cdf2d3b43572b46e5fdab612447e9f9ff34fa2abcc0aaa002b3a7f22820fcaae

Analysis

Target
27715eb83aabe077bf3fee260d740cc2.exe
Size 2.4MB
Sample210304-s56dxtwdb6
SHA256 cdf2d3b43572b46e5fdab612447e9f9ff34fa2abcc0aaa002b3a7f22820fcaae
MD5 27715eb83aabe077bf3fee260d740cc2
SHA1 83e70a3f843dd44ff41e0379a9071a506ba16f68
SHA512 53252b894388ce6ad3da7924c2997e6b1dcc720773e1be76deece33f1d0e02b24e0eea17154a6e1abb7f2f138da8569e7d06ba5aa72adfc330bb6de8beb2a541
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1900	27715eb83aabe077bf3fee260d740cc2.exe

C:\Users\Admin\AppData\Local\Temp\27715eb83aabe077bf3fee260d740cc2.exe
"C:\Users\Admin\AppData\Local\Temp\27715eb83aabe077bf3fee260d740cc2.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1900-2-0x0000000076271000-0x0000000076273000-memory.dmp

Download