d5c1748701e48f0e714a7fa6e984b2273b1640f2f8206651fee1054b69a4e0db

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 01:19

Target

d5c1748701e48f0e714a7fa6e984b2273b1640f2f8206651fee1054b69a4e0db.exe
Size

353KB
MD5

2e7b918599c5b629aa223db84b0fcf9c
SHA1

5aa7e601df83f656ea47553a42bd94420347aa8b
SHA256

d5c1748701e48f0e714a7fa6e984b2273b1640f2f8206651fee1054b69a4e0db
SHA512

615d14b8ab2d59defb3518b9307aaa0415d3ec98a263225e989f3feae118397cfdc200b1094f711131772499ac2fabb3c000c4e75cce3b145f8e8ddded8f1df7
SSDEEP

6144:bWLtjh5WqhvibR2tv1hmf0uiHbZo/ylwjZMRzz/7jorwCotvV/JkjpeMpuLj3eoe:+95Wqhv6MvvC0l7yk8Zu//abI6jpet7e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1600	d5c1748701e48f0e714a7fa6e984b2273b1640f2f8206651fee1054b69a4e0db.exe
1600	d5c1748701e48f0e714a7fa6e984b2273b1640f2f8206651fee1054b69a4e0db.exe

C:\Users\Admin\AppData\Local\Temp\d5c1748701e48f0e714a7fa6e984b2273b1640f2f8206651fee1054b69a4e0db.exe
"C:\Users\Admin\AppData\Local\Temp\d5c1748701e48f0e714a7fa6e984b2273b1640f2f8206651fee1054b69a4e0db.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1600

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/1600-56-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download
memory/1600-66-0x0000000000400000-0x00000000005AE000-memory.dmp

Filesize
1.7MB

Download