bfc312303ecef49a1273e2db49c21872715f6499a1f8c9d3aaca7d0249b5fe4e

Analysis

max time kernel
33s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:05

Target

bfc312303ecef49a1273e2db49c21872715f6499a1f8c9d3aaca7d0249b5fe4e.exe
Size

250KB
MD5

1feb2132b2cce76b74abb952d44ac02b
SHA1

f45635e9683e5cdb3ef192843b4b4abdb2c45d5d
SHA256

bfc312303ecef49a1273e2db49c21872715f6499a1f8c9d3aaca7d0249b5fe4e
SHA512

805ba02bbcbc22ec203433945391290d994a8f306c37e211e04d6921b5a4fcb77f69e82185a47f45bd7aaf749d3f0b0edea0cb91e1cf053aabadf0cbf9cdc425
SSDEEP

6144:UnPv02XMDXGXID5PhImEUgek2jGCeARpBC:2s2XMrrhImEdRuQAE

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1348	bfc312303ecef49a1273e2db49c21872715f6499a1f8c9d3aaca7d0249b5fe4e.exe

C:\Users\Admin\AppData\Local\Temp\bfc312303ecef49a1273e2db49c21872715f6499a1f8c9d3aaca7d0249b5fe4e.exe
"C:\Users\Admin\AppData\Local\Temp\bfc312303ecef49a1273e2db49c21872715f6499a1f8c9d3aaca7d0249b5fe4e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1348

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1348-56-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1348-57-0x0000000074721000-0x0000000074723000-memory.dmp

Filesize
8KB

Download