a250747adf462c3a7649d1bd7981a17046e86870074ce75a38de64f19666cbc0

Analysis

max time kernel
17s
max time network
102s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 20:14

Target

a250747adf462c3a7649d1bd7981a17046e86870074ce75a38de64f19666cbc0.exe
Size

41KB
MD5

8c69f379500ec2cbad7abb6de0844474
SHA1

fe07e22829df1199f25702b13c40b3b679f694f6
SHA256

a250747adf462c3a7649d1bd7981a17046e86870074ce75a38de64f19666cbc0
SHA512

88ce228c75d4b0cd26777de8366a211a0b1490fee9a01761526a80c5232006f74e83d0bd58850d8b41aef2ae7158f48cdac772154351cd46d813a35e6224c384
SSDEEP

384:/TmClqe03sTi6IKVxuGl0IrFlSKl5fDU2kknhu1jKnv7D3y:/qClqgTVIgxxk0U7mu1jKvC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1632	a250747adf462c3a7649d1bd7981a17046e86870074ce75a38de64f19666cbc0.exe

C:\Users\Admin\AppData\Local\Temp\a250747adf462c3a7649d1bd7981a17046e86870074ce75a38de64f19666cbc0.exe
"C:\Users\Admin\AppData\Local\Temp\a250747adf462c3a7649d1bd7981a17046e86870074ce75a38de64f19666cbc0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1632

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1632-56-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download