b37668d0d4b4a31ec48e16fc335172b5df0c69c83609ab71a3705d27ed2cd23a

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:14

Target

b37668d0d4b4a31ec48e16fc335172b5df0c69c83609ab71a3705d27ed2cd23a.exe
Size

638KB
MD5

ece0b1afffb310ba185daa29b0aec2c3
SHA1

399034b50c0211c52f5ca51bb22f0435842663a5
SHA256

b37668d0d4b4a31ec48e16fc335172b5df0c69c83609ab71a3705d27ed2cd23a
SHA512

a3a3db8014487e9d04bfea5393933685711fca9799671a2e07a6d17915817a0c2985717bd7de68c955eba5bb0b9a4a5874a1945dce9ae4244fdbe6ca4f0239f4
SSDEEP

12288:NuudhYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfyjloMDPeu/CDxwL6P7:NuehYT/hmflRBmqPeQ93D4AQKjOMDPFQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1492	b37668d0d4b4a31ec48e16fc335172b5df0c69c83609ab71a3705d27ed2cd23a.exe

C:\Users\Admin\AppData\Local\Temp\b37668d0d4b4a31ec48e16fc335172b5df0c69c83609ab71a3705d27ed2cd23a.exe
"C:\Users\Admin\AppData\Local\Temp\b37668d0d4b4a31ec48e16fc335172b5df0c69c83609ab71a3705d27ed2cd23a.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1492

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x0000000074E71000-0x0000000074E73000-memory.dmp

Filesize
8KB

Download