fe1713e55460646baa092f9183b096ce30303b5542fabd2cd0d572ab36f45bfa

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 17:42

Target

fe1713e55460646baa092f9183b096ce30303b5542fabd2cd0d572ab36f45bfa.exe
Size

132KB
MD5

77148b3ba5ab519f133b2e9388a2da5d
SHA1

2b4b4a6851b22e2f9ab5ac985a51a334359793ac
SHA256

fe1713e55460646baa092f9183b096ce30303b5542fabd2cd0d572ab36f45bfa
SHA512

3ce24f75cfecf92bfe6f6c829a94a06b0511be04a0a2753c48a714df619c6cd5fff2bd8ee78cb6a3f71347e9459504941c19c85ecad6c8ded63b2a7029312a12
SSDEEP

3072:h9dpy+veE8kXm3P+AG3v3/nX3GH4zRut5vTRm7G2B9F:TdoeRu3RwhzF

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1056	fe1713e55460646baa092f9183b096ce30303b5542fabd2cd0d572ab36f45bfa.exe
1056	fe1713e55460646baa092f9183b096ce30303b5542fabd2cd0d572ab36f45bfa.exe

C:\Users\Admin\AppData\Local\Temp\fe1713e55460646baa092f9183b096ce30303b5542fabd2cd0d572ab36f45bfa.exe
"C:\Users\Admin\AppData\Local\Temp\fe1713e55460646baa092f9183b096ce30303b5542fabd2cd0d572ab36f45bfa.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1056

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1056-57-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download