bfa4e44e428afe92d09447cd1f94e256ed165f56b085ce4abbe07b7ebfa41638

Analysis

max time kernel
160s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:05

Target

bfa4e44e428afe92d09447cd1f94e256ed165f56b085ce4abbe07b7ebfa41638.exe
Size

564KB
MD5

54306b1a41be024fa23a4786d836e78b
SHA1

c16ef6c4ae9e8a1641f1a1f651c9d3ce5ffab89e
SHA256

bfa4e44e428afe92d09447cd1f94e256ed165f56b085ce4abbe07b7ebfa41638
SHA512

45c35273e25c59208d67031cfa0baf0b91ad11712e6fcd2a68673fbd4ebda7cc3461228d4c96d4aba3678f437a64be1ec1e048365ad2cfa3b77cfd9fb9336ac5
SSDEEP

12288:oGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAR:o/IdQ8KglrNYltim/GRJx8AR

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4280	bfa4e44e428afe92d09447cd1f94e256ed165f56b085ce4abbe07b7ebfa41638.exe

C:\Users\Admin\AppData\Local\Temp\bfa4e44e428afe92d09447cd1f94e256ed165f56b085ce4abbe07b7ebfa41638.exe
"C:\Users\Admin\AppData\Local\Temp\bfa4e44e428afe92d09447cd1f94e256ed165f56b085ce4abbe07b7ebfa41638.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4280

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact