b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:50

Target

b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92.exe
Size

915KB
MD5

5337eeda4525b5e42fc18aba263bce30
SHA1

30a5e2225cf34b9041b29cc06a8033bf75675b15
SHA256

b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92
SHA512

6e3a396116f5606406eb1b462a5b67083184bbd1abd8817041843c6b5c7c4fdc7621c64952199373bb79a8043519429e9174a4cc9608c7da810cb7b7e8a458c2
SSDEEP

12288:A/0Dc8Yk8zFcetqZQ1exgfiHEQFYBe3y+AhWOsWzxY2SpRwks3z:Z2kqcetqSAxgfQF3yDgOsgx3SpRwkO

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92.exe

pid	process
1948	b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92.exe
1948	b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92.exe
1948	b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92.exe

C:\Users\Admin\AppData\Local\Temp\b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92.exe
"C:\Users\Admin\AppData\Local\Temp\b6f8a58832f5edb79ab2e9419e98068bb0d995308b8cdfc516c7e0b4b1152f92.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1948-54-0x0000000076031000-0x0000000076033000-memory.dmp

Filesize
8KB

Download
memory/1948-55-0x0000000000400000-0x00000000006B0000-memory.dmp

Filesize
2.7MB

Download