c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729

General

Target

c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
Size

168KB
MD5

1498745dda2df027e965d62ebbe094e4
SHA1

734759d96c77afbf89ab22c83e8dde9509e3710b
SHA256

c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729
SHA512

fd86c8ac31362babf603a3df08cf0f19494db2c3ab686ebd41cfb8de2013bf6ccf1992a5431319e93b16df48b43ca481d894ae0962e4be79caa23575f60e405a
SSDEEP

1536:Tu8GMjTco7VrBjNuqylpK7sPzUbax1d98d+IewSZW8bRZvJels/ucNgecEj6:Tdzco7VN7ArUbax1HPIlSZfR8CRc86

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe

pid	process
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe

pid process

2628 c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe

pid	process
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
2628	c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe

C:\Users\Admin\AppData\Local\Temp\c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe
"C:\Users\Admin\AppData\Local\Temp\c24da069b85af9d0b2e93b2c5ac4593919ce6547c0efb3852ffafcf845b72729.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads