e5330c643d4bb190887552d70bdb2bb1da222e3d5d1e0a4330fed88ed5656764

Analysis

max time kernel
125s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:56

Target

e5330c643d4bb190887552d70bdb2bb1da222e3d5d1e0a4330fed88ed5656764.exe
Size

564KB
MD5

f2bd3945b383489b8de452e5f2e33efa
SHA1

da905d2634213f748e1690a3192fa35f03e0bed7
SHA256

e5330c643d4bb190887552d70bdb2bb1da222e3d5d1e0a4330fed88ed5656764
SHA512

73f3ac09856e92ef2bab1933e5a5b00a967ceb2fa731867f005c1c5cdbd185314b173cc360ff5d6c225a8b44afbda18ba329af8df241de0636f0a321381e14d9
SSDEEP

12288:nGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAZ:n/IdQ8KglrNYltim/GRJx8AZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	e5330c643d4bb190887552d70bdb2bb1da222e3d5d1e0a4330fed88ed5656764.exe

C:\Users\Admin\AppData\Local\Temp\e5330c643d4bb190887552d70bdb2bb1da222e3d5d1e0a4330fed88ed5656764.exe
"C:\Users\Admin\AppData\Local\Temp\e5330c643d4bb190887552d70bdb2bb1da222e3d5d1e0a4330fed88ed5656764.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2224

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact