148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885

Analysis

max time kernel
106s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 03:07

Target

148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885.exe
Size

868KB
MD5

04ee7f6b52d4a69ba07a3e928daabe0c
SHA1

7df0433e2c7f687b18462d30d4188ddd7baf801d
SHA256

148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885
SHA512

59968c34055944541ff9f200a21a6bd8bbbdd723677a8face8462780ecd4e722df141b53320632fe241a1713d26a03e546d2037a47839a0b375d1e70b72b3031
SSDEEP

12288:HAYZjZEgJu+dyiWW3qJw5nfYNM1RXToLx8jcDQFi+Q5LUTau7H+3IlH:7l0+JQwnOU8sH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\IESettingSync	148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5036	148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885.exe
5036	148729470ddec739126fe80f1b7a405a9db323200105508f9f55f9c8d6cfb885.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/5036-133-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download
memory/5036-134-0x0000000000400000-0x0000000000505000-memory.dmp

Filesize
1.0MB

Download