93d1fd70a153ac285babf1d07f017c48576dee1b1db9c4c662da9d3e02182ee7

Analysis

max time kernel
11s
max time network
48s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 04:35

Target

93d1fd70a153ac285babf1d07f017c48576dee1b1db9c4c662da9d3e02182ee7.exe
Size

18KB
MD5

bf4900acd88818e169331235fecea3a8
SHA1

903afc675bafaf3c34257140b18700d341f09bed
SHA256

93d1fd70a153ac285babf1d07f017c48576dee1b1db9c4c662da9d3e02182ee7
SHA512

81fa17bcfb3737bd165279a03baeaf80e826bc79ccd4b55fd71fdb01ed8cb61e25e10a2eb4e07bd096ea72b405c81facaaa8ad6c4ab36ff0fe3ebde7cdc9c525
SSDEEP

192:DMHEPQV9GeaJ5f360KAgCvIMi+MIojwFCAJcw:nQV9SJ5vd5v/i+MpsoAJB

Score

4^/10

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\WINDOWS\cdpi.exe	93d1fd70a153ac285babf1d07f017c48576dee1b1db9c4c662da9d3e02182ee7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\93d1fd70a153ac285babf1d07f017c48576dee1b1db9c4c662da9d3e02182ee7.exe
"C:\Users\Admin\AppData\Local\Temp\93d1fd70a153ac285babf1d07f017c48576dee1b1db9c4c662da9d3e02182ee7.exe"
1⤵
- Drops file in Windows directory
PID:1376

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1376-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

Filesize
8KB

Download