78b9e2f94ac65f2e720319559b80560f891d7c3d66e0fc0b7b1ec1c8f62b2120

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:26

Target

78b9e2f94ac65f2e720319559b80560f891d7c3d66e0fc0b7b1ec1c8f62b2120.exe
Size

562KB
MD5

d28b34f91ef299b90089c1df755226bb
SHA1

162c97735973bc454f5c9b14f6c113e572eb4bc3
SHA256

78b9e2f94ac65f2e720319559b80560f891d7c3d66e0fc0b7b1ec1c8f62b2120
SHA512

8145018b1d30146fd6da5fa05dad3e8f2cda4cc0854a23976a0ad3b12b5d11c793b0b829dcce0bf0a612846e3ccff0235abf7b67f71cbc3af9858834477aca7f
SSDEEP

12288:TCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFP:TChqKgU79usbkx+VNJhofz765h9

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1816	78b9e2f94ac65f2e720319559b80560f891d7c3d66e0fc0b7b1ec1c8f62b2120.exe

C:\Users\Admin\AppData\Local\Temp\78b9e2f94ac65f2e720319559b80560f891d7c3d66e0fc0b7b1ec1c8f62b2120.exe
"C:\Users\Admin\AppData\Local\Temp\78b9e2f94ac65f2e720319559b80560f891d7c3d66e0fc0b7b1ec1c8f62b2120.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1816-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1816-55-0x0000000074A61000-0x0000000074A63000-memory.dmp

Filesize
8KB

Download