f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 07:43

Target

f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07.exe
Size

1.7MB
MD5

5858db8eafe237f20878bd9d8b393cae
SHA1

1e6530aada1cbb940d3799283a2fa5096ee2d01d
SHA256

f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07
SHA512

e32f2c93be8847a740ee3159138600e82d55e3110e8e423a2bcebf0e651f4d65b6ba081376026d085fba027bf3e060ee9a9bc6cc93e4eb23088411685744b861
SSDEEP

24576:uArpVBGLlYoys5mAYo/e7/JWtz/0iZeWWlG4C2jaVayys1vHyYyo+/f:uivG6oys3/0JEIlG4sly+H9A

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07.exe

pid process

536 f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07.exe

pid	process
536	f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07.exe

C:\Users\Admin\AppData\Local\Temp\f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07.exe
"C:\Users\Admin\AppData\Local\Temp\f7de7b4f13426156c9a8f61f32dfff8a144a92e6496ebbc677684b7f6101cf07.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:536

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/536-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download