6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:32

Target

6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe
Size

564KB
MD5

bc851922004c0f07712ab6dadd154ea8
SHA1

c6d7e7f2bc7cab654fbca2a74376ccfeedf4316c
SHA256

6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7
SHA512

359c6b8cf3b4337dbd8c5f9e63126932feec4d6ce651fccc83afb8b63c67020e421f5c16a743f545cf769efeceb576b73fb13d82de85c8b7c2296a9de96c03be
SSDEEP

12288:1GQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAX:1/IdQ8KglrNYltim/GRJx8AX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1860	6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe

C:\Users\Admin\AppData\Local\Temp\6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe
"C:\Users\Admin\AppData\Local\Temp\6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1860

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1860-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1860-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download