97b0486c6c4df9d7a0a6279a4a63cc15b39214eeec056c31a947181b214572a4

Analysis

max time kernel
78s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 04:53

Target

97b0486c6c4df9d7a0a6279a4a63cc15b39214eeec056c31a947181b214572a4.exe
Size

16KB
MD5

5bfcfff25c52426a181a18f47506d898
SHA1

d3a06f464b7bd54351c3d15af53d1759ec7bcf39
SHA256

97b0486c6c4df9d7a0a6279a4a63cc15b39214eeec056c31a947181b214572a4
SHA512

b5790a99864b89c8b9882fcf66cba109eaafdf6df5a9e078ae6c4782802d1ff32cfa376ebc54185d7420b7c68a750b4e68fc8fd81d430da2923e39a4fc1a872a
SSDEEP

96:6r18mXdGLAiFqxyhAshxihDHPtboynu+:g8mXdGLAiYxVsXQP1oynu+

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\KB952567-mouse.log	97b0486c6c4df9d7a0a6279a4a63cc15b39214eeec056c31a947181b214572a4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\97b0486c6c4df9d7a0a6279a4a63cc15b39214eeec056c31a947181b214572a4.exe
"C:\Users\Admin\AppData\Local\Temp\97b0486c6c4df9d7a0a6279a4a63cc15b39214eeec056c31a947181b214572a4.exe"
1⤵
- Drops file in Windows directory
PID:1256

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1256-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/1256-55-0x0000000074581000-0x0000000074583000-memory.dmp

Filesize
8KB

Download