f01e7f42e74f65642bcad5fdadb72dbb0a729eea4f2602ae59baa483a9d89a1a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 20:35

Target

StartUp.exe
Size

248KB
MD5

88f1e9a373ebf5a364effa9437f988be
SHA1

2919eb0920c9a9d4dda1faa8194a995f0ddeb5e5
SHA256

5545f221cd2022b761887ef40c627123ce153a8b2f59d80b3ad6290e1f3c978e
SHA512

2136f996546f0b7e85939ff97d53b93e0aff05c2011e448704aa6c88c2820686c095790fc6f8eba85c9688ed6abd3811df521572c511f896d43622a49e13a476
SSDEEP

6144:GZjzQMBeyu/n6b+uTDcMBlju3ZuXkbJjvnwVZAm3ddjhH:GZjMMdhT1zkbZvnwVD

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3140	StartUp.exe

C:\Users\Admin\AppData\Local\Temp\StartUp.exe
"C:\Users\Admin\AppData\Local\Temp\StartUp.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact