30f1d0746a84e64d085c89812909a6f32198c06a9c1e475b1524f4bfc1380337

Analysis

max time kernel
29s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:08

Target

30f1d0746a84e64d085c89812909a6f32198c06a9c1e475b1524f4bfc1380337.exe
Size

564KB
MD5

2fca1878730387625d2cd2efeef02874
SHA1

998e5624c38c313abb30cda857b0441fc8b60cd8
SHA256

30f1d0746a84e64d085c89812909a6f32198c06a9c1e475b1524f4bfc1380337
SHA512

0850a27a5bf949a0d53cbbff9e1292e835a36dbbe109b5ed1ee8bc6e793f907cf6ff385df28999281a71f0c05b360cebe426b60783cbf83617418165dcc02ed4
SSDEEP

12288:vGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAKU:v/IdQ8KglrNYltim/GRJx8AB

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	30f1d0746a84e64d085c89812909a6f32198c06a9c1e475b1524f4bfc1380337.exe

C:\Users\Admin\AppData\Local\Temp\30f1d0746a84e64d085c89812909a6f32198c06a9c1e475b1524f4bfc1380337.exe
"C:\Users\Admin\AppData\Local\Temp\30f1d0746a84e64d085c89812909a6f32198c06a9c1e475b1524f4bfc1380337.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1932-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1932-55-0x0000000074131000-0x0000000074133000-memory.dmp

Filesize
8KB

Download