193b1ed14b5299de7e2b938038d2ddda0097df730cbd547b769c769db36b1e17

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 09:58

Target

193b1ed14b5299de7e2b938038d2ddda0097df730cbd547b769c769db36b1e17.exe
Size

831KB
MD5

d155c7b360e43caaf06b7e6827a57633
SHA1

8e6853cbcdf759b36a94a35eb9f356a915003d6b
SHA256

193b1ed14b5299de7e2b938038d2ddda0097df730cbd547b769c769db36b1e17
SHA512

f171d2a389481e7380229c5aecb9e558c76685a6555ad2e634df0f1df8d20abcbd35f31dc21ccdd516446998642013ebc5fafc20c4a0a4e12fbba67325872ff2
SSDEEP

12288:+quuJcz/jvPAcHtbL2uzpazN3uaL3hJx/D311ULEWIKWc2a0b:Duicr8cNbpzwB+arhJx/D33l0XDg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	193b1ed14b5299de7e2b938038d2ddda0097df730cbd547b769c769db36b1e17.exe

C:\Users\Admin\AppData\Local\Temp\193b1ed14b5299de7e2b938038d2ddda0097df730cbd547b769c769db36b1e17.exe
"C:\Users\Admin\AppData\Local\Temp\193b1ed14b5299de7e2b938038d2ddda0097df730cbd547b769c769db36b1e17.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1712

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1712-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1712-55-0x0000000074281000-0x0000000074283000-memory.dmp

Filesize
8KB

Download