48946aab558977d94b07f5096abed2ef0eb9a7ed90269771629bd2a86ba58a11

Analysis

max time kernel
187s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 10:27

Target
48946aab558977d94b07f5096abed2ef0eb9a7ed90269771629bd2a86ba58a11.exe
Size 637KB
Sample221129-mhkgfaae82
SHA256 48946aab558977d94b07f5096abed2ef0eb9a7ed90269771629bd2a86ba58a11
MD5 eac201aad9eed062736b4632db5cc994
SHA1 9f8af769519f4181b00bc05ea1822ccf747ab7c3
SHA512 7e61f073148267a9c194e14b4479fb877e9fb23ad60e8f8a78ff6467c801adc7400ca1c57c491ce6827fc3b1e697f3f87ac34eb41063aafe799dca9d6d16e0a4
SSDEEP 12288:auudlYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfNGuzJI9I6d4Yp6IG:auelYT/hmflRBmqPeQ93D4AQ1GuCOo4v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	48946aab558977d94b07f5096abed2ef0eb9a7ed90269771629bd2a86ba58a11.exe

C:\Users\Admin\AppData\Local\Temp\48946aab558977d94b07f5096abed2ef0eb9a7ed90269771629bd2a86ba58a11.exe
"C:\Users\Admin\AppData\Local\Temp\48946aab558977d94b07f5096abed2ef0eb9a7ed90269771629bd2a86ba58a11.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1732

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact