3432f8859cb2f7084e14063d3876f46dd9239acefbe3b7e8cc6580c7c58d6f23

Analysis

max time kernel
181s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 13:04

Target

3432f8859cb2f7084e14063d3876f46dd9239acefbe3b7e8cc6580c7c58d6f23.exe
Size

370KB
MD5

f9cc451014a57803edfaf0b14c0f4b6c
SHA1

7b71a15ad1351a418c59b6c7c3d8d8fcc668402b
SHA256

3432f8859cb2f7084e14063d3876f46dd9239acefbe3b7e8cc6580c7c58d6f23
SHA512

b0157917ee4df08d3becaf6b57daca047f64805620762c4a342d6ed407b980d80a21e77042227d0b2e94729693f4f25845db44ff54336ed71a97dadfc26eb11e
SSDEEP

6144:bY0/hhwqpzPca4Aazf6xrCBi+WQpdiD/tltylMyTDdaS7ij2ruLGk5fJKx7/RYhI:bbhwCzKQVQWMfBXos5t

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3432f8859cb2f7084e14063d3876f46dd9239acefbe3b7e8cc6580c7c58d6f23.lnk	3432f8859cb2f7084e14063d3876f46dd9239acefbe3b7e8cc6580c7c58d6f23.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3432f8859cb2f7084e14063d3876f46dd9239acefbe3b7e8cc6580c7c58d6f23.exe
"C:\Users\Admin\AppData\Local\Temp\3432f8859cb2f7084e14063d3876f46dd9239acefbe3b7e8cc6580c7c58d6f23.exe"
1⤵
- Drops startup file
PID:1636

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1636-132-0x0000000003200000-0x000000000322C000-memory.dmp

Filesize
176KB

Download