ba99c63df4ef6c05d326f22b35f5cd15c5ae025303ee00d1332af23c6aa18200

Analysis

max time kernel
121s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 14:39

Target

ba99c63df4ef6c05d326f22b35f5cd15c5ae025303ee00d1332af23c6aa18200.exe
Size

256KB
MD5

7127c82c5ca10657e704f07a0d56566f
SHA1

51cb29c5f69da7ebbbb63aea980dd83a91a14cd8
SHA256

ba99c63df4ef6c05d326f22b35f5cd15c5ae025303ee00d1332af23c6aa18200
SHA512

fe282dc2bc0d210b57cc20cf82478aab7cfd17131d2be541636389783a69e15bd424d3a2915f9835c5a29403c35d6c5c4921042e3393b766d6a0ffef81fb56b0
SSDEEP

6144:v+5evfWlqNQDPRLWLHN+eH4pf59kvA1Iudieu5oO:GEWlwGVWB+5ejuIf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1596	ba99c63df4ef6c05d326f22b35f5cd15c5ae025303ee00d1332af23c6aa18200.exe
1596	ba99c63df4ef6c05d326f22b35f5cd15c5ae025303ee00d1332af23c6aa18200.exe

C:\Users\Admin\AppData\Local\Temp\ba99c63df4ef6c05d326f22b35f5cd15c5ae025303ee00d1332af23c6aa18200.exe
"C:\Users\Admin\AppData\Local\Temp\ba99c63df4ef6c05d326f22b35f5cd15c5ae025303ee00d1332af23c6aa18200.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1596

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1596-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download