1475ef4e222f503989cb2995bbd29d91cf98955ba71215bbcba4d3282bd42d19

Analysis

max time kernel
416s
max time network
489s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 16:35

Target

1475ef4e222f503989cb2995bbd29d91cf98955ba71215bbcba4d3282bd42d19.exe
Size

196KB
MD5

1121a3baf64cdca2d7fda8680e4892f0
SHA1

f296c64398546743ba28d1d35db27f079fed963c
SHA256

1475ef4e222f503989cb2995bbd29d91cf98955ba71215bbcba4d3282bd42d19
SHA512

f2c5a91be695598560243c54b316ef0691ba180d9efece1d71d3bf761729e8cf06283af7740693b5266cfb4f47e660de5520f6858a6a44a74ba2f66bcd4a7252
SSDEEP

6144:t3aWGHOU6Pr7FXlbWc3PuV/rvGXUf39GZjJ21OhCJiviq2YWDppF7eb:t3zPr7FXlbWc3PuV/r+XUf39GZjJ21Of

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4372	1475ef4e222f503989cb2995bbd29d91cf98955ba71215bbcba4d3282bd42d19.exe

C:\Users\Admin\AppData\Local\Temp\1475ef4e222f503989cb2995bbd29d91cf98955ba71215bbcba4d3282bd42d19.exe
"C:\Users\Admin\AppData\Local\Temp\1475ef4e222f503989cb2995bbd29d91cf98955ba71215bbcba4d3282bd42d19.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4372

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact