f0f2d6886cb9b4f76fe711bd9ba4e9c3abafecbd955f3f8328cfc26041acaf77

Analysis

max time kernel
149s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:26

Target

f0f2d6886cb9b4f76fe711bd9ba4e9c3abafecbd955f3f8328cfc26041acaf77.exe
Size

637KB
MD5

01f663394358163034bed9cfe777328d
SHA1

172fa312da63683d6052fea460e0f25268e75ffd
SHA256

f0f2d6886cb9b4f76fe711bd9ba4e9c3abafecbd955f3f8328cfc26041acaf77
SHA512

919331ca67bdfd6d6f7a760a3bfa11da00209f046473120a576e54af4c04ed313c03548583f211c93948033df05223242389c26cb38c14880e84b519abf283d1
SSDEEP

12288:KuudlYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfNGuzJI9I6d4Yp6D:KuelYT/hmflRBmqPeQ93D4AQ1GuCOo4J

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	f0f2d6886cb9b4f76fe711bd9ba4e9c3abafecbd955f3f8328cfc26041acaf77.exe

C:\Users\Admin\AppData\Local\Temp\f0f2d6886cb9b4f76fe711bd9ba4e9c3abafecbd955f3f8328cfc26041acaf77.exe
"C:\Users\Admin\AppData\Local\Temp\f0f2d6886cb9b4f76fe711bd9ba4e9c3abafecbd955f3f8328cfc26041acaf77.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2416

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact