fe3e7850f7fa077340c3cd219217a606dd3431cf79d5d839118796120ce5618a

Analysis

max time kernel
112s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2022, 19:17

Target

fe3e7850f7fa077340c3cd219217a606dd3431cf79d5d839118796120ce5618a.exe
Size

16KB
MD5

8699bb2c27a675cb4711a50183352638
SHA1

387100078b7d7d2a916f3f5e7744216eda95af5a
SHA256

fe3e7850f7fa077340c3cd219217a606dd3431cf79d5d839118796120ce5618a
SHA512

bdeb2c78610c6fbea8fd0e7d0bb13a1805b7b09b20999e6ac98c52a6e119e8fb8b5a4c78868a9b63fbfbfbbae11e3134f3413f35720a928065ad23c3f178ff01
SSDEEP

48:yr7FHimKq7m26OU/32wvI8dsbCP1yoMTSjl0RIaOH5zNLcMDLL55j56g0FwR0EfB:e7d6TmtCAmjl+I3HFLD355jWEi2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4876	fe3e7850f7fa077340c3cd219217a606dd3431cf79d5d839118796120ce5618a.exe

C:\Users\Admin\AppData\Local\Temp\fe3e7850f7fa077340c3cd219217a606dd3431cf79d5d839118796120ce5618a.exe
"C:\Users\Admin\AppData\Local\Temp\fe3e7850f7fa077340c3cd219217a606dd3431cf79d5d839118796120ce5618a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4876

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4876-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download