a83ccb2fbbba40e76f641954788e96e94c2faaecb8148f77d8001ae9adb8d25d

Analysis

max time kernel
39s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:12

Target

a83ccb2fbbba40e76f641954788e96e94c2faaecb8148f77d8001ae9adb8d25d.exe
Size

633KB
MD5

62a6b2afdbd0ed1aa9d6a32b5c1dde12
SHA1

58762bfb4ce2922f737dca475ada5967bb8c5a0c
SHA256

a83ccb2fbbba40e76f641954788e96e94c2faaecb8148f77d8001ae9adb8d25d
SHA512

eef3920b8f1ddb32a93aeb1c01e8c78d78741b77669e16ef33a7d828a30ba0435e928533cb244d6bcaca165f8ec5a9e7051c839e5b7c0d1cf29b58bb26fba0d7
SSDEEP

12288:1uudQYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfxO99de5FXVBQMv91No:1ueQYT/hmflRBmqPeQ93D4AQJOPde5Fs

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	a83ccb2fbbba40e76f641954788e96e94c2faaecb8148f77d8001ae9adb8d25d.exe

C:\Users\Admin\AppData\Local\Temp\a83ccb2fbbba40e76f641954788e96e94c2faaecb8148f77d8001ae9adb8d25d.exe
"C:\Users\Admin\AppData\Local\Temp\a83ccb2fbbba40e76f641954788e96e94c2faaecb8148f77d8001ae9adb8d25d.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1676

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1676-54-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download
memory/1676-55-0x0000000074221000-0x0000000074223000-memory.dmp

Filesize
8KB

Download