a62c9e0eb7c4e3c41886f2ea06e2e7e4a39d0f7dc39699fcd81848cf2922ea61

Analysis

max time kernel
325s
max time network
387s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 16:42

Target

a62c9e0eb7c4e3c41886f2ea06e2e7e4a39d0f7dc39699fcd81848cf2922ea61.exe
Size

240KB
MD5

15d8c936511813e55f355c73e7f7caf0
SHA1

838b5707c8d89d17244652c1925a46ceac28e644
SHA256

a62c9e0eb7c4e3c41886f2ea06e2e7e4a39d0f7dc39699fcd81848cf2922ea61
SHA512

606507cc6e1cebdf9d144e370da8d61f6e9c0e1243250094c142f89674ce636e80e9773edb2ba720982562bfb01e90ffc22d6eb25426a926a9f07bb28ae61c1c
SSDEEP

3072:COjKRvE2jQdrgUDdCGAX31X7tlcxEHglJsd1/Ab32yZlOsQqO1j99MJQ:acdlcX31X7tlMGFTy6sQvh

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2432	a62c9e0eb7c4e3c41886f2ea06e2e7e4a39d0f7dc39699fcd81848cf2922ea61.exe

C:\Users\Admin\AppData\Local\Temp\a62c9e0eb7c4e3c41886f2ea06e2e7e4a39d0f7dc39699fcd81848cf2922ea61.exe
"C:\Users\Admin\AppData\Local\Temp\a62c9e0eb7c4e3c41886f2ea06e2e7e4a39d0f7dc39699fcd81848cf2922ea61.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2432

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact