d34f96d401a3c043f78c90d69c8dd2eeb8dd73e9831998a2c16356c9f10f9356

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 14:17

Target

d34f96d401a3c043f78c90d69c8dd2eeb8dd73e9831998a2c16356c9f10f9356.exe
Size

232KB
MD5

79fb8aa418de6831b7c7049be6af7cc4
SHA1

80f57e962ec133f590c4c0fb48cc442ec097f4be
SHA256

d34f96d401a3c043f78c90d69c8dd2eeb8dd73e9831998a2c16356c9f10f9356
SHA512

965e78a8dc8aa77dbfaac12ed28733350bc9ea4c6982336edfedebcea37d6a6083f4dc7806a51297bcc2d7d5010d0997e7a289de9d2fdd7e82db3aa051f81c54
SSDEEP

6144:C6cK3PG1G93XvUJDcEvjT4qfeZoG+A3yDrE:C69u1G93cJYwMqfel+AiD

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1408	d34f96d401a3c043f78c90d69c8dd2eeb8dd73e9831998a2c16356c9f10f9356.exe

C:\Users\Admin\AppData\Local\Temp\d34f96d401a3c043f78c90d69c8dd2eeb8dd73e9831998a2c16356c9f10f9356.exe
"C:\Users\Admin\AppData\Local\Temp\d34f96d401a3c043f78c90d69c8dd2eeb8dd73e9831998a2c16356c9f10f9356.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1408

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1408-56-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download
memory/1408-57-0x0000000074271000-0x0000000074273000-memory.dmp

Filesize
8KB

Download
memory/1408-58-0x0000000073FC1000-0x0000000073FC3000-memory.dmp

Filesize
8KB

Download
memory/1408-67-0x0000000074211000-0x0000000074213000-memory.dmp

Filesize
8KB

Download
memory/1408-68-0x0000000073FC1000-0x0000000073FC3000-memory.dmp

Filesize
8KB

Download