69172e30edd7237285d375d195300c311dcd197f4c271d727362220f3dafc451

Analysis

max time kernel
5s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:44

Target

69172e30edd7237285d375d195300c311dcd197f4c271d727362220f3dafc451.exe
Size

731KB
MD5

c6a03cbfdb95304a0abc0a304bd24595
SHA1

0ac55596061df77064a7aac733486324b142d761
SHA256

69172e30edd7237285d375d195300c311dcd197f4c271d727362220f3dafc451
SHA512

3fcff1b4a66e7828382d5c4cdf1d8a69b1e89b88f14bbea4e8033d05d5188036f356c8eca847adc0bab54fd7fba3630e67b0587b730699069927b3c5006efb43
SSDEEP

12288:Yuud4YcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQf1Ym1eGu8+VK4jogDO8:Yue4YT/hmflRBmqPeQ93D4AQhenlIIok

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2020	69172e30edd7237285d375d195300c311dcd197f4c271d727362220f3dafc451.exe

C:\Users\Admin\AppData\Local\Temp\69172e30edd7237285d375d195300c311dcd197f4c271d727362220f3dafc451.exe
"C:\Users\Admin\AppData\Local\Temp\69172e30edd7237285d375d195300c311dcd197f4c271d727362220f3dafc451.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:2020

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2020-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000074571000-0x0000000074573000-memory.dmp

Filesize
8KB

Download