8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 23:51

Target

8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c.exe
Size

32KB
MD5

a1fbb78bb4a1d8f7de9180b884c89a04
SHA1

61443dbff3fa70bdd54369a203690c5ea62d6b38
SHA256

8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c
SHA512

4011483638a22e1fcb384129a98ef82679b45248ec053a244af346982bb041eeb62f483415285712c7e15ed4cec424227e6972c7576147a77b7092d59b678f8a
SSDEEP

768:sw406lrOxEWyLYORvgU/iGHe2nbHIpqF9:sF0mrtRvgEiG+IowF9

Score

4^/10

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\5GVRR1NB\BQQTOJ0PW6N3.exe	8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c.exe
File opened for modification	C:\Program Files\5GVRR1NB\BQQTOJ0PW6N3.exe	8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c.exe
File created	C:\Program Files\5GVRR1NB\7RU5A.exe	8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c.exe
File opened for modification	C:\Program Files\5GVRR1NB\7RU5A.exe	8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3444	8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c.exe
3444	8005d10c8b0ba482d898d7c9b2be5d6b33af65b14f8d0765b85e8b8db226c36c.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact