e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c

Analysis

max time kernel
106s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 08:57

Target

e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe
Size

564KB
MD5

52f725b84954ffc2f878872c0d07ddef
SHA1

0296e0e2e966affd8b6c9652718047fa7aaf14bf
SHA256

e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c
SHA512

e073487812a851c4230b1fc3c77a872ab3b6969ff2efd78802e276fa869f6ddd03b75a0054ebb5567a61bf09d33924344745222c4f51a68e2bfdcf280d65920a
SSDEEP

12288:gGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAy:g/IdQ8KglrNYltim/GRJx8Ay

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1780	e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe

C:\Users\Admin\AppData\Local\Temp\e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe
"C:\Users\Admin\AppData\Local\Temp\e40d4863d92cf075877d3ede1f6935bc8a8a14dab0892735733c9789d2d1de1c.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1780

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact