7f69fc3d2e7a0c3579b4adb16d10d5f1e51b5115d61830c476adcd19a942ebe1

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:21

Target

7f69fc3d2e7a0c3579b4adb16d10d5f1e51b5115d61830c476adcd19a942ebe1.exe
Size

369KB
MD5

529aff7e06658e6ef99b2bc6704ec06c
SHA1

3c5475e0937d92a301394d6d3ba9b1429d1b1970
SHA256

7f69fc3d2e7a0c3579b4adb16d10d5f1e51b5115d61830c476adcd19a942ebe1
SHA512

6ea29a2a255604ca5e8384582bae43452da8dad63187e0a626419c66135074a1ebcde51394c3a6af1109c069b333a2bc7b53943b4a5c3af63a28397661cc47f9
SSDEEP

6144:cDWWHcT7m/PETYAz8YbOHskx36PqP1F7w46UAv99XZ8Q7MuuEvw8YOdAUgMNJB:cxk7m/PEMA+sC32qPT7UvNJB

Score

7^/10

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7f69fc3d2e7a0c3579b4adb16d10d5f1e51b5115d61830c476adcd19a942ebe1.lnk	7f69fc3d2e7a0c3579b4adb16d10d5f1e51b5115d61830c476adcd19a942ebe1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7f69fc3d2e7a0c3579b4adb16d10d5f1e51b5115d61830c476adcd19a942ebe1.exe
"C:\Users\Admin\AppData\Local\Temp\7f69fc3d2e7a0c3579b4adb16d10d5f1e51b5115d61830c476adcd19a942ebe1.exe"
1⤵
- Drops startup file
PID:4584

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4584-132-0x00000000039D0000-0x00000000039FC000-memory.dmp

Filesize
176KB

Download