4b84a4004fa52402e3ca6ca317b27a723f0d268de2cd5ef7009bd9b5debf7e25

Analysis

max time kernel
369s
max time network
481s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 23:25

Target

4b84a4004fa52402e3ca6ca317b27a723f0d268de2cd5ef7009bd9b5debf7e25.exe
Size

88KB
MD5

64162576b343cce9fda6eda3a19e5750
SHA1

e273027f60628a9e583b631bea41b557a609b957
SHA256

4b84a4004fa52402e3ca6ca317b27a723f0d268de2cd5ef7009bd9b5debf7e25
SHA512

cc3a8e6aebbff71b4d4742e829c4c5caa0d86a3f8d62206a62eb54113989d14b7c3919c67665a14ccec91877404a162526a59ad9cbc4203774d26883893ba3e9
SSDEEP

1536:NlZhEUdUsyvIyWGgXQAKkOBY5GCz4Z6wKDOFJGUzOZqZBYagHx++:1PE944EtU4qZ+a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2852	4b84a4004fa52402e3ca6ca317b27a723f0d268de2cd5ef7009bd9b5debf7e25.exe

C:\Users\Admin\AppData\Local\Temp\4b84a4004fa52402e3ca6ca317b27a723f0d268de2cd5ef7009bd9b5debf7e25.exe
"C:\Users\Admin\AppData\Local\Temp\4b84a4004fa52402e3ca6ca317b27a723f0d268de2cd5ef7009bd9b5debf7e25.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2852

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact