ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937

Analysis

max time kernel
181s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 13:52

Target

ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe
Size

6.5MB
MD5

677ec949fbaa9a0c239ae3d687c4ac3e
SHA1

c1361759961fb6a6075db50b1beab595f09e9e81
SHA256

ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937
SHA512

aa6acfae74bb5705212445a62db387f58ee23d4207e6e96dc35b0d98282e2e698f4977b855028f8967a10ffdb77d5f0e548b293a4938aaade583c81298e639a6
SSDEEP

196608:Tfgm9lf8tqkU6S6Ve6UHFwuntt/JzHiRsN:T4140NlUlwuntt/NesN

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1428	ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe

C:\Users\Admin\AppData\Local\Temp\ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe
"C:\Users\Admin\AppData\Local\Temp\ff627091b30097be72db34dd6689b27295924ac4de4f29b36630ef4c6ee7f937.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1428

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1428-132-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1428-133-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download
memory/1428-134-0x0000000000400000-0x0000000000735000-memory.dmp

Filesize
3.2MB

Download