76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb

Analysis

max time kernel
36s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:27

Target

76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe
Size

821KB
MD5

171ac60e1b345013417a2cc5cdc160c2
SHA1

399895a0a63560bb707dedae166accbdac4e67bf
SHA256

76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb
SHA512

92330cc3da08386e7f4a0a4e065d8e62fa31840091b22eca4f7771f2063cfacbbe81c770f7d296cb11b8efa3c349760c8939f1b551528c57f7d113c410fdbdb4
SSDEEP

24576:buiRr8cNbpzwB+ax11A1qFRix1DP1YuJucU:budcNpkB+wA1qFRixbYuJZU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe

C:\Users\Admin\AppData\Local\Temp\76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe
"C:\Users\Admin\AppData\Local\Temp\76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1140-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1140-55-0x0000000074C61000-0x0000000074C63000-memory.dmp

Filesize
8KB

Download