3d54baa5b641c5a4fb41898d47e32d6cf4a0374cd9dbd0b8521a8b1b36a8a5ed

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:50

Target

3d54baa5b641c5a4fb41898d47e32d6cf4a0374cd9dbd0b8521a8b1b36a8a5ed.exe
Size

562KB
MD5

8c719f66fcf6d122fcf8d1561e2be67a
SHA1

49381f83dbf201781478d13eb1fab535ca8403af
SHA256

3d54baa5b641c5a4fb41898d47e32d6cf4a0374cd9dbd0b8521a8b1b36a8a5ed
SHA512

7afab7558a8c92a5f32b075f285649039d47393e85f6cb9799cdfc6d4652c8ffa1ecc52945dfa1cd4f1c2c732354c4e1fa107ec22553c978d2c98c94cdedb3b5
SSDEEP

12288:7CK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFJ:7ChqKgU79usbkx+VNJhofz765hT

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1464	3d54baa5b641c5a4fb41898d47e32d6cf4a0374cd9dbd0b8521a8b1b36a8a5ed.exe

C:\Users\Admin\AppData\Local\Temp\3d54baa5b641c5a4fb41898d47e32d6cf4a0374cd9dbd0b8521a8b1b36a8a5ed.exe
"C:\Users\Admin\AppData\Local\Temp\3d54baa5b641c5a4fb41898d47e32d6cf4a0374cd9dbd0b8521a8b1b36a8a5ed.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1464

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1464-54-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1464-55-0x0000000074081000-0x0000000074083000-memory.dmp

Filesize
8KB

Download