0b77aba57480645468441bec03e383e41ccb05af97cf953f85be98c4c602da48

Analysis

max time kernel
21s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 21:40

Target

0b77aba57480645468441bec03e383e41ccb05af97cf953f85be98c4c602da48.exe
Size

943KB
MD5

5625eae1657dc106cbeb3ff60d82e939
SHA1

85bc0c3d5b10e8d8cd9260330d6e9649b7e557b7
SHA256

0b77aba57480645468441bec03e383e41ccb05af97cf953f85be98c4c602da48
SHA512

db72c96f7a9b1de80305ce338c7a9ae5530c74cbef0d53c259eab0aeaf2b2ddaff645c6be568dfe3727ae571285968df66e9bbfa35aaf03f62ad1c6931557120
SSDEEP

12288:GzYNdMxQnEe4rP2pnUxD37mhgMOtXqH733mz+oy/ES20g:SY4xQnEVrPqUxD3ggns733mz+oy/7E

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\svghost.exe	0b77aba57480645468441bec03e383e41ccb05af97cf953f85be98c4c602da48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0b77aba57480645468441bec03e383e41ccb05af97cf953f85be98c4c602da48.exe
"C:\Users\Admin\AppData\Local\Temp\0b77aba57480645468441bec03e383e41ccb05af97cf953f85be98c4c602da48.exe"
1⤵
- Drops file in Windows directory
PID:1788

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1788-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download