79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e

Analysis

max time kernel
257s
max time network
316s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 18:51

Target

79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e.exe
Size

1016KB
MD5

5363730898d77d9b8374b0fc57ca4520
SHA1

a51bd285c4f2309533c6696fa3023843869b521d
SHA256

79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e
SHA512

2bb86aa6835d6c6d2f66ba53bf1dd4a66d008ed386a5ee485bc5a755ce2949aaea6910396d74f9a70b00660f9ed7c6c751c62f3604ded1ff12ffc114a8a3f970
SSDEEP

6144:jIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:jIXsgtvm1De5YlOx6lzBH46Umu1q

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3796	79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e.exe
3796	79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e.exe

C:\Users\Admin\AppData\Local\Temp\79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e.exe
"C:\Users\Admin\AppData\Local\Temp\79cb60306cffed3fa5841630284d7bb19e478548aa707c23f687f81d305ee16e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact