e050b95f709f434d69580cf30c54bf06b6a482f06bd7ae7525b2ad1599eada31

Analysis

max time kernel
355s
max time network
412s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 16:34

Target

e050b95f709f434d69580cf30c54bf06b6a482f06bd7ae7525b2ad1599eada31.exe
Size

2.8MB
MD5

d0c0aedab1ffe83e5c311412cb10a0a0
SHA1

47dab2a81a70b3883b63c09e9293813527517438
SHA256

e050b95f709f434d69580cf30c54bf06b6a482f06bd7ae7525b2ad1599eada31
SHA512

c081db82348ced31067e995577152899d66a8f06a33e42e333f2e8200d6b10ca36512ba8be91d449312f0f4d22dacb1312a0776198b905c6cf3f8dbc9addc92a
SSDEEP

49152:rbppnfD0THFzwQ4ALYzQFYNkP1AYGPDfI1rNxc1qQLrbTNu7RsVkph7YIMi7S:rl5fORh4ALYMTNAYkfIlonAOVW7YIm

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4148	e050b95f709f434d69580cf30c54bf06b6a482f06bd7ae7525b2ad1599eada31.exe
4148	e050b95f709f434d69580cf30c54bf06b6a482f06bd7ae7525b2ad1599eada31.exe

C:\Users\Admin\AppData\Local\Temp\e050b95f709f434d69580cf30c54bf06b6a482f06bd7ae7525b2ad1599eada31.exe
"C:\Users\Admin\AppData\Local\Temp\e050b95f709f434d69580cf30c54bf06b6a482f06bd7ae7525b2ad1599eada31.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4148

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact