d85cb5782191f71eef0b0a9cfe856bc58d756644dd80b5b24065b3b6c48f1356

Analysis

max time kernel
154s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 08:59

Target

d85cb5782191f71eef0b0a9cfe856bc58d756644dd80b5b24065b3b6c48f1356.exe
Size

831KB
MD5

5ffb320d2d3b04e3bf62c0e4d069d04f
SHA1

e2bbfd6b835743e077fda0c0837d836da9ac9e5e
SHA256

d85cb5782191f71eef0b0a9cfe856bc58d756644dd80b5b24065b3b6c48f1356
SHA512

c6d55d22daf95dab555ae32e61bee5214f23794daf6249b3b1c9f03c47121c6a063a165626e56bc4289419e8afe1fb6b8d163be6506e9d7f7a482e3ef4891a5c
SSDEEP

12288:OquuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2aX:zuicr8cNbpzwB+arhJx/D33l0XDX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5112	d85cb5782191f71eef0b0a9cfe856bc58d756644dd80b5b24065b3b6c48f1356.exe

C:\Users\Admin\AppData\Local\Temp\d85cb5782191f71eef0b0a9cfe856bc58d756644dd80b5b24065b3b6c48f1356.exe
"C:\Users\Admin\AppData\Local\Temp\d85cb5782191f71eef0b0a9cfe856bc58d756644dd80b5b24065b3b6c48f1356.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact