6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7

Analysis

max time kernel
153s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 09:32

Target

6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe
Size

564KB
MD5

bc851922004c0f07712ab6dadd154ea8
SHA1

c6d7e7f2bc7cab654fbca2a74376ccfeedf4316c
SHA256

6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7
SHA512

359c6b8cf3b4337dbd8c5f9e63126932feec4d6ce651fccc83afb8b63c67020e421f5c16a743f545cf769efeceb576b73fb13d82de85c8b7c2296a9de96c03be
SSDEEP

12288:1GQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAX:1/IdQ8KglrNYltim/GRJx8AX

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4740	6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe

C:\Users\Admin\AppData\Local\Temp\6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe
"C:\Users\Admin\AppData\Local\Temp\6af49f510f9f5cc75e7e20a83553a19c7d0b2bd88c181e043f7b3add62116bc7.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4740

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact