54997b3a185bb73053e5dde15e7bd265463d9a3cd8bedc93290329de84dd5422

Analysis

max time kernel
152s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2022, 06:53

Target

Company Profile.exe
Size

138KB
MD5

5ef9770e747140ed283a43f0c2404174
SHA1

3bdecc8b3a2df4919e5a0c0517558c083a06e23d
SHA256

54997b3a185bb73053e5dde15e7bd265463d9a3cd8bedc93290329de84dd5422
SHA512

2e57288641a1d22f5a88170c2236a5390a9a65154e14ffb9ee9f6feebe7a89227178abfccc8782cbe7ce903137ad32c536a1e31bdd84de393e724845554c2c99
SSDEEP

3072:SBkfJpRXATwMdFCcAiiPiaakFrgXWy8+sOBmxw9yPI7sR0bUg7TEnI2def8AoVGv:SqjIOiiPiaIjtx7OI2efkVGxwIQL+

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Goddamn\Afskedsbreve\Ischuretic.Wav	Company Profile.exe
File opened for modification	C:\Windows\resources\0409\Vernacularizing183.ini	Company Profile.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Company Profile.exe
"C:\Users\Admin\AppData\Local\Temp\Company Profile.exe"
1⤵
- Drops file in Windows directory
PID:1364

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact