cdc3eb3ed52d65d02f4dd548ea834d7d931c847bd946c32640c3f95bae27a718

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2022, 17:43

Target

cdc3eb3ed52d65d02f4dd548ea834d7d931c847bd946c32640c3f95bae27a718.exe
Size

132KB
MD5

631c2cdc53c58bde60664912d80fd2be
SHA1

e7eee7024f1a7af273443d182038544f90595329
SHA256

cdc3eb3ed52d65d02f4dd548ea834d7d931c847bd946c32640c3f95bae27a718
SHA512

2181aff21bff0ca1d8e0ac785287a7f0010136515e4c4950cd8fa640443d874fcebf10e58e1dc407a3e3941dc0d6aca65089c4263e0c223c5f92c5b2f511f41b
SSDEEP

1536:n9rdQfa9dpKjde38GbOMc85y/shf3VWbPJlIUhq/yQ2NwmK38RdTG2efa9y:P9dpyGbOMcIy/s9FoPJlDhq457G2B9y

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2800	cdc3eb3ed52d65d02f4dd548ea834d7d931c847bd946c32640c3f95bae27a718.exe
2800	cdc3eb3ed52d65d02f4dd548ea834d7d931c847bd946c32640c3f95bae27a718.exe

C:\Users\Admin\AppData\Local\Temp\cdc3eb3ed52d65d02f4dd548ea834d7d931c847bd946c32640c3f95bae27a718.exe
"C:\Users\Admin\AppData\Local\Temp\cdc3eb3ed52d65d02f4dd548ea834d7d931c847bd946c32640c3f95bae27a718.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact