4ef24736a7b2e2f2518fb09275cf0d4d0a6f13fe011e840e040a67850d89cc3e

Analysis

max time kernel
26s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:44

Target

4ef24736a7b2e2f2518fb09275cf0d4d0a6f13fe011e840e040a67850d89cc3e.exe
Size

638KB
MD5

beef20ee2d6b737025b8fd5dcc02b3ff
SHA1

7de815470a710bd2b1fc4100e723f9e820655511
SHA256

4ef24736a7b2e2f2518fb09275cf0d4d0a6f13fe011e840e040a67850d89cc3e
SHA512

f3f48991491b6da66722b808763c93c8fc0adf57e261973085955823dafe59ec715f9767bda5be09cf2822eba4a65cf56c2aba20dd269a78823e577996996dd7
SSDEEP

12288:cuudWYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfy3pxp7JExG4MuMMT+Mpqi:cueWYT/hmflRBmqPeQ93D4AQq3vNJuGE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1092	4ef24736a7b2e2f2518fb09275cf0d4d0a6f13fe011e840e040a67850d89cc3e.exe

C:\Users\Admin\AppData\Local\Temp\4ef24736a7b2e2f2518fb09275cf0d4d0a6f13fe011e840e040a67850d89cc3e.exe
"C:\Users\Admin\AppData\Local\Temp\4ef24736a7b2e2f2518fb09275cf0d4d0a6f13fe011e840e040a67850d89cc3e.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1092

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1092-54-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1092-55-0x0000000074681000-0x0000000074683000-memory.dmp

Filesize
8KB

Download