97eca824dda16ae4046d570cc6579d38502d737656e630aef036213404621be1

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 16:31

Target

97eca824dda16ae4046d570cc6579d38502d737656e630aef036213404621be1.exe
Size

28KB
MD5

d73a3827ebac3d648df9a78bd1b473a8
SHA1

ad973cfc5e0c11e3a8c138bb86692921ea63452c
SHA256

97eca824dda16ae4046d570cc6579d38502d737656e630aef036213404621be1
SHA512

a49a48395910fbaa7ca5a0c094fbf527223e119c59c11f663ee77df81a45ba24d74623e2ae27d1ffe66ca136d9ed8606870adec1d98f14fbb4124544ba0f863b
SSDEEP

384:kUbDDSc2eu+xiEX7IyJNBjP0iuGiNHTyVAb4D40yoH3bI:kUbSc2ecEXcyJroVG2pGWkM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1848	97eca824dda16ae4046d570cc6579d38502d737656e630aef036213404621be1.exe

C:\Users\Admin\AppData\Local\Temp\97eca824dda16ae4046d570cc6579d38502d737656e630aef036213404621be1.exe
"C:\Users\Admin\AppData\Local\Temp\97eca824dda16ae4046d570cc6579d38502d737656e630aef036213404621be1.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1848

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact