e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:57

Target

e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe
Size

564KB
MD5

52f725b84954ffc2f878872c0d07ddef
SHA1

0296e0e2e966affd8b6c9652718047fa7aaf14bf
SHA256

e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c
SHA512

e073487812a851c4230b1fc3c77a872ab3b6969ff2efd78802e276fa869f6ddd03b75a0054ebb5567a61bf09d33924344745222c4f51a68e2bfdcf280d65920a
SSDEEP

12288:gGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAy:g/IdQ8KglrNYltim/GRJx8Ay

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1896	e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe

C:\Users\Admin\AppData\Local\Temp\e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe
"C:\Users\Admin\AppData\Local\Temp\e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1896

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1896-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1896-55-0x0000000074EF1000-0x0000000074EF3000-memory.dmp

Filesize
8KB

Download