71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5

Analysis

max time kernel
39s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:26

Target

71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5.exe
Size

3.5MB
MD5

3084a8f5dc3d30148e27630ce4b2ee3f
SHA1

f3f02383ab33d3fdaf39b39dae160fad256a034c
SHA256

71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5
SHA512

7663dc190e2c6b7cd5fbcbe7afa8fb362e7d8cde7bec96b33cf36aefc96a631b232110edb277db05b830dbda6d3aaba2480332ee643f3cc79f21bab397cb242b
SSDEEP

98304:LL/v5vwyBOaMR65MvSop69ugFzw3HciN3QIcIZXB:LLpvxBLMR6mSB1ZwsihcIZXB

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5.exe

pid process

752 71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5.exe

pid	process
752	71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5.exe

C:\Users\Admin\AppData\Local\Temp\71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5.exe
"C:\Users\Admin\AppData\Local\Temp\71a977e1c3392a023d9752fb30bd1c47bf96c64834018d1ea7fcfb9e01e60ae5.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:752

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/752-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download