05e1716943d2b7bf32b5a94eaaee9de25cad67a5bafd27ff084897f2a63d3aec

Analysis

max time kernel
99s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:22

Target

05e1716943d2b7bf32b5a94eaaee9de25cad67a5bafd27ff084897f2a63d3aec.exe
Size

564KB
MD5

1af823395ef7642763e2694327d84d71
SHA1

da7f6706acd3e88273a033fe6e2e2af9338daf85
SHA256

05e1716943d2b7bf32b5a94eaaee9de25cad67a5bafd27ff084897f2a63d3aec
SHA512

7cb2d7a5e1fe83f48f9a527f11432a2f5d0174a4a886efce4eaa2735e1108adb98691e95d8919f87da698d6b1d14928e9cdf5e809dd23918fd71f6178b2aa256
SSDEEP

12288:vGQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAP:v/IdQ8KglrNYltim/GRJx8AP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	05e1716943d2b7bf32b5a94eaaee9de25cad67a5bafd27ff084897f2a63d3aec.exe

C:\Users\Admin\AppData\Local\Temp\05e1716943d2b7bf32b5a94eaaee9de25cad67a5bafd27ff084897f2a63d3aec.exe
"C:\Users\Admin\AppData\Local\Temp\05e1716943d2b7bf32b5a94eaaee9de25cad67a5bafd27ff084897f2a63d3aec.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1952

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1952-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/1952-55-0x0000000074491000-0x0000000074493000-memory.dmp

Filesize
8KB

Download