d120b0a0b9a17cf73379add86b26ea643d95e88f633ebb0af681d743b93eee67

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 12:56

Target

d120b0a0b9a17cf73379add86b26ea643d95e88f633ebb0af681d743b93eee67.exe
Size

564KB
MD5

1f92b88eb5d9748320b04162e8fb9f3c
SHA1

8b2f19dc44bd1e3b1c837aa8420730b743ae2f7d
SHA256

d120b0a0b9a17cf73379add86b26ea643d95e88f633ebb0af681d743b93eee67
SHA512

f53406c8d134557c5ea6bb36bfcfb49f5d5e6062437a9166ca49342b15bc144e65b9e659bc3ad47dd3880678d308625c97366dbbf4e0c8e736c3db1e777b0e8b
SSDEEP

12288:3GQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAg:3/IdQ8KglrNYltim/GRJx8Ag

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1468	d120b0a0b9a17cf73379add86b26ea643d95e88f633ebb0af681d743b93eee67.exe

C:\Users\Admin\AppData\Local\Temp\d120b0a0b9a17cf73379add86b26ea643d95e88f633ebb0af681d743b93eee67.exe
"C:\Users\Admin\AppData\Local\Temp\d120b0a0b9a17cf73379add86b26ea643d95e88f633ebb0af681d743b93eee67.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1468

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1468-54-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1468-55-0x0000000074721000-0x0000000074723000-memory.dmp

Filesize
8KB

Download