76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb

Analysis

max time kernel
194s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 09:27

Target

76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe
Size

821KB
MD5

171ac60e1b345013417a2cc5cdc160c2
SHA1

399895a0a63560bb707dedae166accbdac4e67bf
SHA256

76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb
SHA512

92330cc3da08386e7f4a0a4e065d8e62fa31840091b22eca4f7771f2063cfacbbe81c770f7d296cb11b8efa3c349760c8939f1b551528c57f7d113c410fdbdb4
SSDEEP

24576:buiRr8cNbpzwB+ax11A1qFRix1DP1YuJucU:budcNpkB+wA1qFRixbYuJZU

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
956	76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe

C:\Users\Admin\AppData\Local\Temp\76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe
"C:\Users\Admin\AppData\Local\Temp\76fd9ea527e692a578f566f4c478efb83c00c4ce8bf8046ccba28b39eafb19cb.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:956

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact