26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 09:53

Target

26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1.exe
Size

504KB
MD5

bc80f1d770af53b60e39f81fe4c3cf8f
SHA1

6b218dbe76abcf745d23cad1ee71874fbdd4a863
SHA256

26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1
SHA512

d51b6daf0b3f38e553e6bf2401801ebf5933e8419bab8bf1e6309c3b549a33d05921101069f4fa24e1812941308ef9166585c40261b1728776610c1ee134a8e0
SSDEEP

12288:pANwRo+mv8QD4+0V16fdlucjvaHnc3IWekzNL8QsouP/g5F:pAT8QE+koBLaHcYf698DP/gD

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Company\NewProduct\serveur.exe	26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1.exe
File opened for modification	C:\Program Files (x86)\Company\NewProduct\Uninstall.exe	26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1.exe
File created	C:\Program Files (x86)\Company\NewProduct\Uninstall.ini	26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1.exe
"C:\Users\Admin\AppData\Local\Temp\26ca2822a2dc43f61663c4985c7dd30a8aeb6e446d8cd1956bcb47377ca770a1.exe"
1⤵
- Drops file in Program Files directory
PID:404

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact