0613e0a15ec51b15e63b3da54182ef2e0e3b5c28be5b489003c269e46086a0a8

Analysis

max time kernel
180s
max time network
201s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 10:28

Target

0613e0a15ec51b15e63b3da54182ef2e0e3b5c28be5b489003c269e46086a0a8.exe
Size

637KB
MD5

5ed7f57a78deacd3bab0e70363cf53f5
SHA1

35e8a33fb6d43bb085238520478cbd1e89eb340f
SHA256

0613e0a15ec51b15e63b3da54182ef2e0e3b5c28be5b489003c269e46086a0a8
SHA512

0d27f21461db087bb63f534ea039a959d662063968dcbade1c2ba257e45528c23a1e82922973a51bbcb6e2bd87ee45e22230d2138dd9c2102ccc22d90400ea91
SSDEEP

12288:6uudlYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfNGuzJI9I6d4Yp65V:6uelYT/hmflRBmqPeQ93D4AQ1GuCOo4t

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4248	0613e0a15ec51b15e63b3da54182ef2e0e3b5c28be5b489003c269e46086a0a8.exe

C:\Users\Admin\AppData\Local\Temp\0613e0a15ec51b15e63b3da54182ef2e0e3b5c28be5b489003c269e46086a0a8.exe
"C:\Users\Admin\AppData\Local\Temp\0613e0a15ec51b15e63b3da54182ef2e0e3b5c28be5b489003c269e46086a0a8.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4248

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact