89abd399c56b70e52e04615e51f391229572efb003ee6b647ef3cb124c54df1f

Analysis

max time kernel
7s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 01:24

Target

89abd399c56b70e52e04615e51f391229572efb003ee6b647ef3cb124c54df1f.exe
Size

320KB
MD5

3019b10087e6a1942db545dc5c618672
SHA1

538e943d67b14b0fdb720d4820b180d9c8dca498
SHA256

89abd399c56b70e52e04615e51f391229572efb003ee6b647ef3cb124c54df1f
SHA512

514060e2aa673007a79272bcc7be7fa3f52d2b66ff70efb5c9a9f30a93e9ad8c924c0677161613e9ec9cad3a39f35123900d888249c76a0009b2b99108ce6130
SSDEEP

6144:dCE06UWVEudvlEvS7/jUq6JkZWspn7SMWJyJz4vz2tr4:dCLurwS7776JkV7SMWJk4vzR

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1736	89abd399c56b70e52e04615e51f391229572efb003ee6b647ef3cb124c54df1f.exe
1736	89abd399c56b70e52e04615e51f391229572efb003ee6b647ef3cb124c54df1f.exe

C:\Users\Admin\AppData\Local\Temp\89abd399c56b70e52e04615e51f391229572efb003ee6b647ef3cb124c54df1f.exe
"C:\Users\Admin\AppData\Local\Temp\89abd399c56b70e52e04615e51f391229572efb003ee6b647ef3cb124c54df1f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1736

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1736-54-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download