3d8af46ce21f837d70da61d9b1108d348b33ebde5fb174da4fffb376656fbb96

Analysis

max time kernel
240s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:50

Target

3d8af46ce21f837d70da61d9b1108d348b33ebde5fb174da4fffb376656fbb96.exe
Size

831KB
MD5

3e71d81a4eb3624aea68067cdd0277c4
SHA1

50b7975fb86605e7aaef02d69ff4fe2dc45fae93
SHA256

3d8af46ce21f837d70da61d9b1108d348b33ebde5fb174da4fffb376656fbb96
SHA512

ca0cef86c1a01df04cdf962f3a2bbfc009b91d49e71cc37be54fff595b1834d7573af6f124b7f4f72f6bac1e8e70d0b48e904dc9ae540b2979c3e175e4431741
SSDEEP

12288:GquuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2ae:Luicr8cNbpzwB+arhJx/D33l0XDe

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
716	3d8af46ce21f837d70da61d9b1108d348b33ebde5fb174da4fffb376656fbb96.exe

C:\Users\Admin\AppData\Local\Temp\3d8af46ce21f837d70da61d9b1108d348b33ebde5fb174da4fffb376656fbb96.exe
"C:\Users\Admin\AppData\Local\Temp\3d8af46ce21f837d70da61d9b1108d348b33ebde5fb174da4fffb376656fbb96.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:716

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/716-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

Filesize
8KB

Download
memory/716-55-0x0000000074461000-0x0000000074463000-memory.dmp

Filesize
8KB

Download