963ae44695002c677819552abfafcacb50f4c1d75f16a54967ce70ede6468c12

Analysis

max time kernel
296s
max time network
349s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 02:17

Target

963ae44695002c677819552abfafcacb50f4c1d75f16a54967ce70ede6468c12.exe
Size

112KB
MD5

04055df8a4d022df03ba279edc19e7e5
SHA1

5dd635633a01fa0d7318d620f4f19ad5200e22ce
SHA256

963ae44695002c677819552abfafcacb50f4c1d75f16a54967ce70ede6468c12
SHA512

efc4c1bb28b8351cf101776cac2533d755e0249ab524b3b9c9bad6cd41bc5853b098af98bbb0a34fd77abf67e9c584116bd733785865013e10929c3668265c56
SSDEEP

3072:7yRoDE9lJlfkX9kXWqgkXAkXAkXAkXtkX8kXQkXhkXIkX/kXdkX+kXmkXJkXMkXT:7yRoDgkX9kXWqgkXAkXAkXAkXtkX8kXl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2724	963ae44695002c677819552abfafcacb50f4c1d75f16a54967ce70ede6468c12.exe

C:\Users\Admin\AppData\Local\Temp\963ae44695002c677819552abfafcacb50f4c1d75f16a54967ce70ede6468c12.exe
"C:\Users\Admin\AppData\Local\Temp\963ae44695002c677819552abfafcacb50f4c1d75f16a54967ce70ede6468c12.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2724

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact