61e4baa2f755308db7e6c5c5e2ead49cd86d3c3fb8b387ca339d1889b28c24b0

Analysis

max time kernel
43s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:06

Target

61e4baa2f755308db7e6c5c5e2ead49cd86d3c3fb8b387ca339d1889b28c24b0.exe
Size

638KB
MD5

9cfca6cb62906c05d6b9076ac4510acb
SHA1

7e5984fea935e205ece94fbd14adedded2b589c1
SHA256

61e4baa2f755308db7e6c5c5e2ead49cd86d3c3fb8b387ca339d1889b28c24b0
SHA512

1eca8aa892b5fc5ba11e922fb4a8fbc165564a3f1c03542c586e2008c852b6d7bb3d344603947fc87b76dae91ffa31d192081590b885c818b9bd403abd04c440
SSDEEP

12288:MuudWYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfy3pxp7JExG4MuMMT+Mpl:MueWYT/hmflRBmqPeQ93D4AQq3vNJuGy

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	61e4baa2f755308db7e6c5c5e2ead49cd86d3c3fb8b387ca339d1889b28c24b0.exe

C:\Users\Admin\AppData\Local\Temp\61e4baa2f755308db7e6c5c5e2ead49cd86d3c3fb8b387ca339d1889b28c24b0.exe
"C:\Users\Admin\AppData\Local\Temp\61e4baa2f755308db7e6c5c5e2ead49cd86d3c3fb8b387ca339d1889b28c24b0.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2020

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2020-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000074D51000-0x0000000074D53000-memory.dmp

Filesize
8KB

Download