f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a

Analysis

max time kernel
152s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 10:05

Target

f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
Size

2.1MB
MD5

1737e6c4103636c342e847d690d52167
SHA1

78fc9e9fa9522d4e1d08d40198e8154ed4132fe7
SHA256

f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a
SHA512

dd8f9d9f9f5d37f0bceca8b251d1cc64b870fb629361e88d3c73068c5d96700fb83f871825bff4ea7f4247eae28b33ab631f4fac196861fd2b9d8c2e354a4fc5
SSDEEP

49152:2kwkn9IMHeaAx3euAAQC9oRehtS+YaDLo0az3HI2aPCS:1dnV2viRNaD8H4lPC

Score

5^/10

Drops file in System32 directory 8 IoCs

Processes:

f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\out.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
File created	C:\Windows\SysWOW64\wall.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
File opened for modification	C:\Windows\SysWOW64\wall.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
File created	C:\Windows\SysWOW64\capnhat.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
File opened for modification	C:\Windows\SysWOW64\capnhat.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
File created	C:\Windows\SysWOW64\play.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
File opened for modification	C:\Windows\SysWOW64\play.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe
File created	C:\Windows\SysWOW64\out.gif	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe

pid process

1796 f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe

pid	process
1796	f3656798e5a9d5493580e00e0e745490214ac2927018e2328aee268198ef965a.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact