1edf18f364e434bc1a1db866f4af616db4eae5ddbec1cc90a6d20668e817be3d

Analysis

max time kernel
39s
max time network
29s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:57

Target

1edf18f364e434bc1a1db866f4af616db4eae5ddbec1cc90a6d20668e817be3d.exe
Size

831KB
MD5

e95b67f0d385101201023773b68f765b
SHA1

958c65f03e823c25db3c4b45f8c0564f1b4ce36d
SHA256

1edf18f364e434bc1a1db866f4af616db4eae5ddbec1cc90a6d20668e817be3d
SHA512

5fd7cc7ea781bc76cfa13db943bcf1fcd031fe22d602ee96c2a11cbcac068f49faf5405c8df1359cfeae99c0a36cd9aa1ca386715326d42f9c00a5f9de6c6a81
SSDEEP

12288:uquuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2a+x:Tuicr8cNbpzwB+arhJx/D33l0XDs

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1812	1edf18f364e434bc1a1db866f4af616db4eae5ddbec1cc90a6d20668e817be3d.exe

C:\Users\Admin\AppData\Local\Temp\1edf18f364e434bc1a1db866f4af616db4eae5ddbec1cc90a6d20668e817be3d.exe
"C:\Users\Admin\AppData\Local\Temp\1edf18f364e434bc1a1db866f4af616db4eae5ddbec1cc90a6d20668e817be3d.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1812

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1812-54-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1812-55-0x0000000074D31000-0x0000000074D33000-memory.dmp

Filesize
8KB

Download