003fa9ada8e1cba5cc03b0ada989518b3e389ee0228bd7bc2bb9078e6fea3605

Analysis

max time kernel
1s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 10:07

Target

003fa9ada8e1cba5cc03b0ada989518b3e389ee0228bd7bc2bb9078e6fea3605.exe
Size

823KB
MD5

5e3f190f40795a7e834eb058d41dd031
SHA1

029200f4f8ff93c010766a7a5f1229bae5a41290
SHA256

003fa9ada8e1cba5cc03b0ada989518b3e389ee0228bd7bc2bb9078e6fea3605
SHA512

e5dafbfd6be652a5cd2fad2edaea4d32a64b87283f8ea47fc541d7425afbb000e46202eaede6f5d04e2145e05a1c79de4430129ce9d89a1b518de25e21f3bcc2
SSDEEP

24576:YueBr8cNbpzwB+afQqkXsW0QU0PtAHXEoTX3wgv9xr:YurcNpkB+RJcr4yH0oTXggv9xr

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	003fa9ada8e1cba5cc03b0ada989518b3e389ee0228bd7bc2bb9078e6fea3605.exe

C:\Users\Admin\AppData\Local\Temp\003fa9ada8e1cba5cc03b0ada989518b3e389ee0228bd7bc2bb9078e6fea3605.exe
"C:\Users\Admin\AppData\Local\Temp\003fa9ada8e1cba5cc03b0ada989518b3e389ee0228bd7bc2bb9078e6fea3605.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1104

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1104-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1104-55-0x00000000741E1000-0x00000000741E3000-memory.dmp

Filesize
8KB

Download