d50ddcb3e67b9ac38cb81fdd0ad181bee0b6b7d84bc1e7c0d6b29df779e94c15

Analysis

max time kernel
177s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 12:05

Target

d50ddcb3e67b9ac38cb81fdd0ad181bee0b6b7d84bc1e7c0d6b29df779e94c15.exe
Size

236KB
MD5

195ce679e08a8de7b1777ed56a6c7855
SHA1

283624ea29b4fa27b31d21b9323f754f963b2b49
SHA256

d50ddcb3e67b9ac38cb81fdd0ad181bee0b6b7d84bc1e7c0d6b29df779e94c15
SHA512

4b4d6962506f2cfded82e36a72a67de342e325c04ea3114cc3df29c55134063465b13a1c7cf7b10afedf67ad7dd052412f18e0c93300029fbb6eba3f71595715
SSDEEP

1536:UtGUM7dfzimQQhs16dT29FWmGgqGmEFasNesjmj3jie:psbkdT29FWvpgxRST9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
980	d50ddcb3e67b9ac38cb81fdd0ad181bee0b6b7d84bc1e7c0d6b29df779e94c15.exe

C:\Users\Admin\AppData\Local\Temp\d50ddcb3e67b9ac38cb81fdd0ad181bee0b6b7d84bc1e7c0d6b29df779e94c15.exe
"C:\Users\Admin\AppData\Local\Temp\d50ddcb3e67b9ac38cb81fdd0ad181bee0b6b7d84bc1e7c0d6b29df779e94c15.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:980

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact