e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 13:59

Target

e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe
Size

48KB
MD5

d7a2bd9ac894338d660926fdbdbde702
SHA1

f3377bf05a6b7a0f4e29a826839de5910e903877
SHA256

e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036
SHA512

60998b8bca18d9160b59c8bfa8c5359888f9b776af58a8101c3e63c5dfbba33671e4e7378fce7e4dbe9f548f49abd8194da6a9c5d56d5542c5d0e69f803f23f3
SSDEEP

768:hXHQB+04j2V5y/zDvnVoQoiFhXXeFKZGodFz9dfALEvRW9Hxb/D2CX9S+izEG:hzLXvnVoQLxXegZu1Jr0r

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\MIME\Database	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	e2b976d66322346913addd07ad3166734d7dd11997d1974781484acfebaa2036.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact