d2b9a92c712bc852006ecb3fbc8c3b7d37b5d8ccaac3dbfed5c8ba687964c5e3

Analysis

max time kernel
64s
max time network
92s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-10-2022 10:16

Target

d2b9a92c712bc852006ecb3fbc8c3b7d37b5d8ccaac3dbfed5c8ba687964c5e3.exe
Size

96KB
MD5

78431fe75fc27309ba11c8c73c119bd0
SHA1

ab79867da5be6dd35acbab7a0cad6774996154ff
SHA256

d2b9a92c712bc852006ecb3fbc8c3b7d37b5d8ccaac3dbfed5c8ba687964c5e3
SHA512

d15ac8c27b6c3fafecd0144f3826cc3977998a4c49d8c9441a1588054a552b3350ef20df688687085b5fc89f985c34b25e5751f11473fa3d1c7c8ba2dd0bd506
SSDEEP

3072:mO3IeCNXm3V+GH3x3/nf3iHGELCEE6yISzANhOEzWv+UkVf:tELCEExISzANhOEzWv+UW

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
860	d2b9a92c712bc852006ecb3fbc8c3b7d37b5d8ccaac3dbfed5c8ba687964c5e3.exe
860	d2b9a92c712bc852006ecb3fbc8c3b7d37b5d8ccaac3dbfed5c8ba687964c5e3.exe

C:\Users\Admin\AppData\Local\Temp\d2b9a92c712bc852006ecb3fbc8c3b7d37b5d8ccaac3dbfed5c8ba687964c5e3.exe
"C:\Users\Admin\AppData\Local\Temp\d2b9a92c712bc852006ecb3fbc8c3b7d37b5d8ccaac3dbfed5c8ba687964c5e3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:860

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/860-57-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download