fce2d3c77c8c5799e1f6f4fce312a82d856ea6eba96955317bd44b8b5fe39d91

Analysis

max time kernel
51s
max time network
72s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 05:38

Target

fce2d3c77c8c5799e1f6f4fce312a82d856ea6eba96955317bd44b8b5fe39d91.exe
Size

988KB
MD5

5bae3bf5891c7941ea40c7b5c32a0fbd
SHA1

59426cd6e1b4875bcbcc02842b225bb4b3f6148e
SHA256

fce2d3c77c8c5799e1f6f4fce312a82d856ea6eba96955317bd44b8b5fe39d91
SHA512

d4bf7efe7ab1e21c8581fc1d12b0c24f29478be8a96c17d0f33eda9b40abe69ef55d9fc5947470ae44a8eae13d5888552eaa8ac1982150c5973836b896ec2037
SSDEEP

24576:4tb20pkaCqT5TBWgNQ7axKHaJa5aGotjm96A:BVg5tQ7axKHaJ4aG2jm5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\root\cimv2	fce2d3c77c8c5799e1f6f4fce312a82d856ea6eba96955317bd44b8b5fe39d91.exe

C:\Users\Admin\AppData\Local\Temp\fce2d3c77c8c5799e1f6f4fce312a82d856ea6eba96955317bd44b8b5fe39d91.exe
"C:\Users\Admin\AppData\Local\Temp\fce2d3c77c8c5799e1f6f4fce312a82d856ea6eba96955317bd44b8b5fe39d91.exe"
1⤵
- NTFS ADS
PID:1792

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1792-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download