a233dd9faf86f1e2f93d179aabe8550c321055342414d2a3da25c57350ac400b

Analysis

max time kernel
43s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 11:42

Target

a233dd9faf86f1e2f93d179aabe8550c321055342414d2a3da25c57350ac400b.exe
Size

362KB
MD5

3e794ff8642fb81d7a902196271d5e20
SHA1

37d1400d73201e0fc3870e25886972137887af68
SHA256

a233dd9faf86f1e2f93d179aabe8550c321055342414d2a3da25c57350ac400b
SHA512

4ca3bd865a3608f5b4bc5706539e1cf3e617c32b9ec2791552eb23c9e0b1a0f81fe70dc46a8d3cc044d5916ed347eb71f61b1d99b99f34b1a315c4aa77d87973
SSDEEP

6144:3w8bg0Zh/N1MOsL1AUf/9q1/tQTbnPAF5wDL/CWR/IW61GUv23ulcKzyKHpP8dBm:3w800Zh/N1MOIf/9qXQTEbWR/IWIvIer

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
524	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\a233dd9faf86f1e2f93d179aabe8550c321055342414d2a3da25c57350ac400b.exe
"C:\Users\Admin\AppData\Local\Temp\a233dd9faf86f1e2f93d179aabe8550c321055342414d2a3da25c57350ac400b.exe"
1⤵
PID:1724

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:524

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\974470_168054593381821_685813244_n[1].jpg

Filesize
20KB

MD5
5cf34a33b2b8c8993fb9b27191ab69a7

SHA1
4ce9f51461220873e4e8e43a2ef43c8259a10abd

SHA256
d6bd76c92130f134220cea962a9a3fd2803b34b86460af8caac9b303b58f6a03

SHA512
4442c10ab15c2b482c9b24a16c9b091452f7e193b9a3bbddf85a5d174d7e0fa96827ad0e591037bca1f436072ecf012d44d31e15f79cf164d1dc47b36130c7c6

Download Submit
memory/1724-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download