1bc75cf24c2ab70e4cd6c98ffe69eaeae47e9bd90b9e0f5a2bf97bff553f85cb

Analysis

max time kernel
153s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-08-2022 06:34

Target

624-147-0x0000000000400000-0x0000000000422000-memory.exe
Size

136KB
MD5

66b734e0d570c5cb3719c2ae3799fb9f
SHA1

eb57c70683f468b24f1ad22fa11738cbf59b76d9
SHA256

1bc75cf24c2ab70e4cd6c98ffe69eaeae47e9bd90b9e0f5a2bf97bff553f85cb
SHA512

6f6b00bf580ba92ce2b6c160cdaf1067d8c1c3adf895baf52b4c6ab6647409653f2680d624dc738a67f10b8a4cf9799fb63f91872171e9f2de23010470c46242
SSDEEP

1536:t/Zws3kTnvzbhNBPmxue2SRQg0dkEwiqoViokHdJQwFrXjm3C:JZTkLfhjFSiO3o6/FHIC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4692	624-147-0x0000000000400000-0x0000000000422000-memory.exe

C:\Users\Admin\AppData\Local\Temp\624-147-0x0000000000400000-0x0000000000422000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\624-147-0x0000000000400000-0x0000000000422000-memory.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4692

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact