4045f69b717812e385ecba65289caf51ad12fffa08b3b46935cd111ced399998

Analysis

max time kernel
236s
max time network
306s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 09:49

Target

4045f69b717812e385ecba65289caf51ad12fffa08b3b46935cd111ced399998.exe
Size

831KB
MD5

2fd43ba3c9f1133f6f1ff1eea8fc90d8
SHA1

0cf3a3b2e4192b91776d3461bdd8ceb8aeb54a48
SHA256

4045f69b717812e385ecba65289caf51ad12fffa08b3b46935cd111ced399998
SHA512

8ec2d4441689e8a701a8a706e1e658bf865afbb0117672408c1c6f47183901cfec22e01f8f7f5ec0c3e826dfc612fd9ff6749e2fa144e4dc91b3f999631cb494
SSDEEP

12288:WquuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2a8:7uicr8cNbpzwB+arhJx/D33l0XD8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4600	4045f69b717812e385ecba65289caf51ad12fffa08b3b46935cd111ced399998.exe

C:\Users\Admin\AppData\Local\Temp\4045f69b717812e385ecba65289caf51ad12fffa08b3b46935cd111ced399998.exe
"C:\Users\Admin\AppData\Local\Temp\4045f69b717812e385ecba65289caf51ad12fffa08b3b46935cd111ced399998.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4600

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact