3ecd65153671ec329601effa0f403be4cfc9373d5f28620f1791132416b9f6d8

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 09:49

Target

3ecd65153671ec329601effa0f403be4cfc9373d5f28620f1791132416b9f6d8.exe
Size

637KB
MD5

57ddb3bce5375908cc59b9b57a7fd0b8
SHA1

d8160194d390c6955191cbbdcfae59b3a60d7938
SHA256

3ecd65153671ec329601effa0f403be4cfc9373d5f28620f1791132416b9f6d8
SHA512

3ac3cedd76bb5886c7ef52013df8e1a738df852f002a1ae3c7009a888760ed58c652cd4dde80bbdec6c896ce03b590564b5e1f5e75e352c07ff7a7f1f4a15c2e
SSDEEP

12288:SuudlYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfNGuzJI9I6d4Yp6Le:SuelYT/hmflRBmqPeQ93D4AQ1GuCOo4U

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1416	3ecd65153671ec329601effa0f403be4cfc9373d5f28620f1791132416b9f6d8.exe

C:\Users\Admin\AppData\Local\Temp\3ecd65153671ec329601effa0f403be4cfc9373d5f28620f1791132416b9f6d8.exe
"C:\Users\Admin\AppData\Local\Temp\3ecd65153671ec329601effa0f403be4cfc9373d5f28620f1791132416b9f6d8.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1416

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1416-55-0x0000000074431000-0x0000000074433000-memory.dmp

Filesize
8KB

Download