0184317422439d20cc26fbc227010331c2f750a203fef9f132425675824ab411

Analysis

max time kernel
2s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 01:06

Target

0184317422439d20cc26fbc227010331c2f750a203fef9f132425675824ab411.exe
Size

324KB
MD5

0acfaa8afa2ce686ab3e566666f39b50
SHA1

64b9ee0a63ca2af5334d07c302e5e55263126c9c
SHA256

0184317422439d20cc26fbc227010331c2f750a203fef9f132425675824ab411
SHA512

d4c974cc0f295ec5d8c2157b716b3cc265a9500faeed983b136f1a5e99a89a7205a203da26d5dd323be78d7026140cce24fcff0a75f7ecdd4fa65f38a5f37c25
SSDEEP

6144:Et0xF8wRSuQ53pGGwi/oHXy1epgJsfv8sOF0v:Et0xM5E7i/oHXCJsfUsh

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1660	0184317422439d20cc26fbc227010331c2f750a203fef9f132425675824ab411.exe
1660	0184317422439d20cc26fbc227010331c2f750a203fef9f132425675824ab411.exe

C:\Users\Admin\AppData\Local\Temp\0184317422439d20cc26fbc227010331c2f750a203fef9f132425675824ab411.exe
"C:\Users\Admin\AppData\Local\Temp\0184317422439d20cc26fbc227010331c2f750a203fef9f132425675824ab411.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1660

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1660-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download