557ee44a638f6671431686b4b4633fbc0ca3de42d5280d0a36c662692ea072a4

Analysis

max time kernel
151s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:41

Target

557ee44a638f6671431686b4b4633fbc0ca3de42d5280d0a36c662692ea072a4.exe
Size

831KB
MD5

39def8e876ea9e0e40617034fc628d7f
SHA1

949f9837b99150e8e6221b32d2d4deeb74846ae9
SHA256

557ee44a638f6671431686b4b4633fbc0ca3de42d5280d0a36c662692ea072a4
SHA512

1013fb9593d9f85c6373773b0632c784f34a6b8881e41e38dfd6bf2131acdbf63539c4766f2e3042eac9059b15b1b5c0c4a4463e3a7e04ef7f0d0382d8e35a5b
SSDEEP

12288:mquuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2a5H:ruicr8cNbpzwB+arhJx/D33l0XDN

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4104	557ee44a638f6671431686b4b4633fbc0ca3de42d5280d0a36c662692ea072a4.exe

C:\Users\Admin\AppData\Local\Temp\557ee44a638f6671431686b4b4633fbc0ca3de42d5280d0a36c662692ea072a4.exe
"C:\Users\Admin\AppData\Local\Temp\557ee44a638f6671431686b4b4633fbc0ca3de42d5280d0a36c662692ea072a4.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4104

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact