ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937

Analysis

max time kernel
82s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe
Size

6.5MB
MD5

677ec949fbaa9a0c239ae3d687c4ac3e
SHA1

c1361759961fb6a6075db50b1beab595f09e9e81
SHA256

ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937
SHA512

aa6acfae74bb5705212445a62db387f58ee23d4207e6e96dc35b0d98282e2e698f4977b855028f8967a10ffdb77d5f0e548b293a4938aaade583c81298e639a6
SSDEEP

196608:Tfgm9lf8tqkU6S6Ve6UHFwuntt/JzHiRsN:T4140NlUlwuntt/NesN

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1368	ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1368	ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe

C:\Users\Admin\AppData\Local\Temp\ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe
"C:\Users\Admin\AppData\Local\Temp\ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1368-55-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1368-56-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1368-57-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download