68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e

Analysis

max time kernel
159s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 16:50

Target

68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e.exe
Size

7KB
MD5

4334c28350cf08985bdb489c7885e7b0
SHA1

19bdf2b54337cc74f43803ab084b03c61d49df67
SHA256

68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e
SHA512

e676ae34cd7c37a3ee1ba3c409f2f65196d561820c16464b87bf2ef8aea85364c3972b67992f4564760fc7caf3356d30b0c56c8dbc9137f7ec6c0cfe5036d67e
SSDEEP

192:ggNJ5UOtC6bBDyBW3l0vdV+icAEBmIg3tQ:U6bBX2vDLaBmIqW

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e.exe

pid process

4764 68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e.exe

pid	process
4764	68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e.exe

C:\Users\Admin\AppData\Local\Temp\68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e.exe
"C:\Users\Admin\AppData\Local\Temp\68b41e83b9e0e03a7de12870c35eccdb325b11a9fc1f1b3c705a65831da5317e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4764

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4764-132-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4764-135-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download