2c56374611bd73192bdc633ce6462ea36d9595fc5422f32c09f98f5cc60e5291

Analysis

max time kernel
175s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:37

Target

2c56374611bd73192bdc633ce6462ea36d9595fc5422f32c09f98f5cc60e5291.exe
Size

900KB
MD5

fae3f94ff17f7538f2ab37779067dec3
SHA1

556c2bb9dbc05fafe6ba1fd623eae20f291b851f
SHA256

2c56374611bd73192bdc633ce6462ea36d9595fc5422f32c09f98f5cc60e5291
SHA512

5418858accf3c3e1a8750b7c620c3c233b45391c0b386b3d52cbb1394549745817f013ae862d8638ec0dff7d70cfe134560f290b19d02fc1c6a0349a183ff227
SSDEEP

24576:atXR40eeU8n6FbklgNXhOpBj+AP+tKazFQIpzV0TO:AR40eknlcmRSrFpzV0T

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1876	2c56374611bd73192bdc633ce6462ea36d9595fc5422f32c09f98f5cc60e5291.exe
1876	2c56374611bd73192bdc633ce6462ea36d9595fc5422f32c09f98f5cc60e5291.exe

C:\Users\Admin\AppData\Local\Temp\2c56374611bd73192bdc633ce6462ea36d9595fc5422f32c09f98f5cc60e5291.exe
"C:\Users\Admin\AppData\Local\Temp\2c56374611bd73192bdc633ce6462ea36d9595fc5422f32c09f98f5cc60e5291.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1876

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact