f409c5f65391740fa2e65918bb950c2a5d558e129414ad3cd563ae950a26be00

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 14:48

Target

f409c5f65391740fa2e65918bb950c2a5d558e129414ad3cd563ae950a26be00.exe
Size

28KB
MD5

77160f33d6cea3f9907e99ae23ffb26e
SHA1

cee9641fa67cbd1e55d4409a0d60adbf0666445d
SHA256

f409c5f65391740fa2e65918bb950c2a5d558e129414ad3cd563ae950a26be00
SHA512

b8afb903aef8aafcbd8896b45323318bc8233fdc70e2f3e48ca69633009cd71332c724c144bba669a64305485b7331ad619e63dc5be906a8913e83c90d4b2aab
SSDEEP

192:/Tc806XczpKLIO6MTGZqR2zEOGtqn0q806XczpKLIO:/TnbcdKMOvqZy2zEOGtqn0hbcdKMO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1324	f409c5f65391740fa2e65918bb950c2a5d558e129414ad3cd563ae950a26be00.exe

C:\Users\Admin\AppData\Local\Temp\f409c5f65391740fa2e65918bb950c2a5d558e129414ad3cd563ae950a26be00.exe
"C:\Users\Admin\AppData\Local\Temp\f409c5f65391740fa2e65918bb950c2a5d558e129414ad3cd563ae950a26be00.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1324

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1324-56-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download