18ddda9f334b21ad5eb1a125b4e53df991d7dbf5b983bf47e09fc381ac86e103

Analysis

max time kernel
39s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:59

Target

18ddda9f334b21ad5eb1a125b4e53df991d7dbf5b983bf47e09fc381ac86e103.exe
Size

831KB
MD5

9b365c4c38e011bdafa94d21e7d73535
SHA1

81433adefd0e53e0691314d13cf8385381b0077c
SHA256

18ddda9f334b21ad5eb1a125b4e53df991d7dbf5b983bf47e09fc381ac86e103
SHA512

811cd1a35b2c69823e66881cc97060b8c992a51aca7f97b92875e0f5b79f34d0ed10ced456e346e09f5f61b9bc049bb548091d9b7182c92666a5c3ca5e19f3db
SSDEEP

12288:KquuJhxz/jvPAcHtbL2uzpazN3uaLcob8Jt1tAJBPOLfVMf4odXa5cG2cH/NE:fuiDr8cNbpzwB+aut4PAf+IaGPe

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
112	18ddda9f334b21ad5eb1a125b4e53df991d7dbf5b983bf47e09fc381ac86e103.exe

C:\Users\Admin\AppData\Local\Temp\18ddda9f334b21ad5eb1a125b4e53df991d7dbf5b983bf47e09fc381ac86e103.exe
"C:\Users\Admin\AppData\Local\Temp\18ddda9f334b21ad5eb1a125b4e53df991d7dbf5b983bf47e09fc381ac86e103.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:112

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-55-0x0000000074021000-0x0000000074023000-memory.dmp

Filesize
8KB

Download