1be5c39f1b26e294ad423f63e23b6748214051297fc058cd5342d3119a251466

Analysis

Target

1be5c39f1b26e294ad423f63e23b6748214051297fc058cd5342d3119a251466.exe
Size

282KB
MD5

1bbd74ffbbecf915c000ed831f09f63d
SHA1

3341fbdbd4b9ba6da455e606bad74f2838e6032a
SHA256

1be5c39f1b26e294ad423f63e23b6748214051297fc058cd5342d3119a251466
SHA512

923496b86bb35ac2e0fc91bd6606bfd88ebf3a88211d5dbb590722ef8ad91c79302a3786466ac43dd4960c35560e9f4144c5900692cf8e84ab896c82e8480a38

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

1be5c39f1b26e294ad423f63e23b6748214051297fc058cd5342d3119a251466.exe

pid	Process
968	1be5c39f1b26e294ad423f63e23b6748214051297fc058cd5342d3119a251466.exe

C:\Users\Admin\AppData\Local\Temp\1be5c39f1b26e294ad423f63e23b6748214051297fc058cd5342d3119a251466.exe
"C:\Users\Admin\AppData\Local\Temp\1be5c39f1b26e294ad423f63e23b6748214051297fc058cd5342d3119a251466.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:968

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/968-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download
memory/968-55-0x0000000000450000-0x000000000045C000-memory.dmp

Filesize
48KB

Download