894fbd404b34814b54bab6b5b183289f04aa46af29487a6437afc2c33a44c51a

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:21

Target

894fbd404b34814b54bab6b5b183289f04aa46af29487a6437afc2c33a44c51a.exe
Size

633KB
MD5

78dd64b835a9501b5ce5231005c908e1
SHA1

0871a763c3e4d2409288ba5fe2e52dbcab7528b8
SHA256

894fbd404b34814b54bab6b5b183289f04aa46af29487a6437afc2c33a44c51a
SHA512

7e8387a4d4cfe1f0ca7142657c1e990f20d71e925e250a11cf458f54e1d396edf3a0b394d9e3525d176462682bd53950a3ea5a6eb359605bfd0372c0d5cbdc9c
SSDEEP

12288:FuudQYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfxO99de5FXVBQMv91NFu:FueQYT/hmflRBmqPeQ93D4AQJOPde5FE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5044	894fbd404b34814b54bab6b5b183289f04aa46af29487a6437afc2c33a44c51a.exe

C:\Users\Admin\AppData\Local\Temp\894fbd404b34814b54bab6b5b183289f04aa46af29487a6437afc2c33a44c51a.exe
"C:\Users\Admin\AppData\Local\Temp\894fbd404b34814b54bab6b5b183289f04aa46af29487a6437afc2c33a44c51a.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:5044

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact