a486f6e0d21278fe44a1049e21cb20fe2e98f13507e94c5b2c1ef25184397c3d

Analysis

max time kernel
74s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 12:47

Target

a486f6e0d21278fe44a1049e21cb20fe2e98f13507e94c5b2c1ef25184397c3d.exe
Size

132KB
MD5

bc0d5a1d16e5f5c8ec18e4158ffd0fd0
SHA1

58c5e27909d5a8bd0b0192964bc42887545e868f
SHA256

a486f6e0d21278fe44a1049e21cb20fe2e98f13507e94c5b2c1ef25184397c3d
SHA512

a00c714955e253a5e95e663baad84d90baa0e0f3e873818451953ec8c45399281a3a10d08b8faed71a863a9df7d9b3b9a6882896cee49c74852e59c15ed2f329
SSDEEP

1536:n9rdQfa9dpKjde38GbOMc85y/shf3VWbPJlIUhq/yQ2NwmK38RdTG2efa94:P9dpyGbOMcIy/s9FoPJlDhq457G2B94

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1752	a486f6e0d21278fe44a1049e21cb20fe2e98f13507e94c5b2c1ef25184397c3d.exe
1752	a486f6e0d21278fe44a1049e21cb20fe2e98f13507e94c5b2c1ef25184397c3d.exe

C:\Users\Admin\AppData\Local\Temp\a486f6e0d21278fe44a1049e21cb20fe2e98f13507e94c5b2c1ef25184397c3d.exe
"C:\Users\Admin\AppData\Local\Temp\a486f6e0d21278fe44a1049e21cb20fe2e98f13507e94c5b2c1ef25184397c3d.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1752

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact