a98334a1953c19b43dd086a336bc650ec218af3c4551ac5f98067557dbb62693

Analysis

max time kernel
47s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:12

Target

a98334a1953c19b43dd086a336bc650ec218af3c4551ac5f98067557dbb62693.exe
Size

638KB
MD5

095c9c096adb1bd6750b346ce3671080
SHA1

9f19999ba1e34190f9b14fd98b1e494dcfac4eda
SHA256

a98334a1953c19b43dd086a336bc650ec218af3c4551ac5f98067557dbb62693
SHA512

4257bdda2699d0bdcef38e04f743e7a7532a5093990c916e5e29eb37dcd33abb70b4830d2a279020e054822afceec2d4b648809d0d605b87b79d7c013a2a6cce
SSDEEP

12288:duudhYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfyjloMDPeu/CDxwL6P9nb:duehYT/hmflRBmqPeQ93D4AQKjOMDPFm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	a98334a1953c19b43dd086a336bc650ec218af3c4551ac5f98067557dbb62693.exe

C:\Users\Admin\AppData\Local\Temp\a98334a1953c19b43dd086a336bc650ec218af3c4551ac5f98067557dbb62693.exe
"C:\Users\Admin\AppData\Local\Temp\a98334a1953c19b43dd086a336bc650ec218af3c4551ac5f98067557dbb62693.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1140-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1140-55-0x0000000074651000-0x0000000074653000-memory.dmp

Filesize
8KB

Download