7be378596efaaff29416703db7ba3ea8f91c80c7b86d48dbbde7e90be9f997f7

Analysis

max time kernel
118s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2022 21:08

Target

7be378596efaaff29416703db7ba3ea8f91c80c7b86d48dbbde7e90be9f997f7.exe
Size

1.4MB
MD5

e812d3c994689119207353dbb77c6ca8
SHA1

6f6c0e1155f8e1454a54339cc3c524e383eb8bcb
SHA256

7be378596efaaff29416703db7ba3ea8f91c80c7b86d48dbbde7e90be9f997f7
SHA512

bd713870ca6414ba24e8575ef983387bbc81bfd636309327701b0a68aee47b81ae8c802089030a89668d6898a0e5a22cc300a0e267b3ef94b7880abea3ffdcc2
SSDEEP

24576:5RmJkcoQricOIQxiZY1iagh0kh/31jthaf6ewHKowA8Ezq0ztbBWsA:WJZoQrbTFZY1iag53dv8VA8EzqD

Score

8^/10

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	7be378596efaaff29416703db7ba3ea8f91c80c7b86d48dbbde7e90be9f997f7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7be378596efaaff29416703db7ba3ea8f91c80c7b86d48dbbde7e90be9f997f7.exe
"C:\Users\Admin\AppData\Local\Temp\7be378596efaaff29416703db7ba3ea8f91c80c7b86d48dbbde7e90be9f997f7.exe"
1⤵
- Drops file in Drivers directory
PID:4880

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact