fd2e877bfc859cbf11e35e1426b8fcca33f3990c333c91b5cd80d801cca0f941

Analysis

max time kernel
35s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 08:52

Target

fd2e877bfc859cbf11e35e1426b8fcca33f3990c333c91b5cd80d801cca0f941.exe
Size

831KB
MD5

b11c9aa2190623a50387e25806af8568
SHA1

3852eb58a74b51ac5046ffbdb71e4af070299aff
SHA256

fd2e877bfc859cbf11e35e1426b8fcca33f3990c333c91b5cd80d801cca0f941
SHA512

0b500948491e5dc7ad4b2b6fa5d09d3beca77ac3139fbdc9937c93768ab72e2579e25da80b162243f34cc8ad4070b01012b2e6cb82f5fc3071ba126b4f17ab4b
SSDEEP

12288:uquuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2aBJ:Tuicr8cNbpzwB+arhJx/D33l0XDv

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1388	fd2e877bfc859cbf11e35e1426b8fcca33f3990c333c91b5cd80d801cca0f941.exe

C:\Users\Admin\AppData\Local\Temp\fd2e877bfc859cbf11e35e1426b8fcca33f3990c333c91b5cd80d801cca0f941.exe
"C:\Users\Admin\AppData\Local\Temp\fd2e877bfc859cbf11e35e1426b8fcca33f3990c333c91b5cd80d801cca0f941.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1388

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download