71268b2bc54f7c34a90af53bc524df62c7d9e1fe093d81dd665f2308df548419

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:29

Target

71268b2bc54f7c34a90af53bc524df62c7d9e1fe093d81dd665f2308df548419.exe
Size

831KB
MD5

51f31fa8adbb12d3f0d391ea5137be54
SHA1

7a705a3a289e83d455c283bd4c5bd8c4857bb8fd
SHA256

71268b2bc54f7c34a90af53bc524df62c7d9e1fe093d81dd665f2308df548419
SHA512

e7498c6dcd2e7851c4b6136dcbc946110945a12e359992b6bd41050cfa617fcbb23eeb2fff155fac2779413993d8dbc72255c38608a101e24435d4e106df5dd7
SSDEEP

12288:TquuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2aT:Wuicr8cNbpzwB+arhJx/D33l0XDT

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1444	71268b2bc54f7c34a90af53bc524df62c7d9e1fe093d81dd665f2308df548419.exe

C:\Users\Admin\AppData\Local\Temp\71268b2bc54f7c34a90af53bc524df62c7d9e1fe093d81dd665f2308df548419.exe
"C:\Users\Admin\AppData\Local\Temp\71268b2bc54f7c34a90af53bc524df62c7d9e1fe093d81dd665f2308df548419.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1444

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1444-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1444-55-0x0000000074791000-0x0000000074793000-memory.dmp

Filesize
8KB

Download