9729020416841d86e544fcd3d4eaf6f21c476c0d252df34165196bd5da646dc6

Analysis

max time kernel
38s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:17

Target

9729020416841d86e544fcd3d4eaf6f21c476c0d252df34165196bd5da646dc6.exe
Size

564KB
MD5

3850630e006655c80d5f2018bc1bad6f
SHA1

ad2d4b11a8c792e8ecc6b609c5b5d8b41c0653a1
SHA256

9729020416841d86e544fcd3d4eaf6f21c476c0d252df34165196bd5da646dc6
SHA512

98d2e501701c57c98b48648fd8ca9c68cb684c24fa4a479d9eb30345e2792b8aea2ba6a4b5728109d4df0ee7d40809dc6d297554b6c6cacbae8ba11bc10c275c
SSDEEP

12288:/GQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAu://IdQ8KglrNYltim/GRJx8Au

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	9729020416841d86e544fcd3d4eaf6f21c476c0d252df34165196bd5da646dc6.exe

C:\Users\Admin\AppData\Local\Temp\9729020416841d86e544fcd3d4eaf6f21c476c0d252df34165196bd5da646dc6.exe
"C:\Users\Admin\AppData\Local\Temp\9729020416841d86e544fcd3d4eaf6f21c476c0d252df34165196bd5da646dc6.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2044

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2044-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/2044-55-0x0000000074CC1000-0x0000000074CC3000-memory.dmp

Filesize
8KB

Download