61842d4d51f0a3f464ed68a0b28ca3d422d552dd5e2f8a3e188a83371ece4181

Analysis

max time kernel
171s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:35

Target

61842d4d51f0a3f464ed68a0b28ca3d422d552dd5e2f8a3e188a83371ece4181.exe
Size

564KB
MD5

4e77aacd9bc536bae594ea5d4ba6186a
SHA1

184d697b9348c0b8cff50ff671bad7caf639ab37
SHA256

61842d4d51f0a3f464ed68a0b28ca3d422d552dd5e2f8a3e188a83371ece4181
SHA512

fc77f6318bc1839267bd8aa295185e4425cd49a26eefeb80af22d832cb90ca10522736bbdbf93a0a7b2227d899e6e586fb2415502140af601364f41414ed23cb
SSDEEP

12288:XGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAKr:X/IdQ8KglrNYltim/GRJx8Aq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	61842d4d51f0a3f464ed68a0b28ca3d422d552dd5e2f8a3e188a83371ece4181.exe

C:\Users\Admin\AppData\Local\Temp\61842d4d51f0a3f464ed68a0b28ca3d422d552dd5e2f8a3e188a83371ece4181.exe
"C:\Users\Admin\AppData\Local\Temp\61842d4d51f0a3f464ed68a0b28ca3d422d552dd5e2f8a3e188a83371ece4181.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2340

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact