5d62945e8c6f3fae4af389a10b4919480f23ae573df73f4a4296d84bf57abda0

Analysis

max time kernel
48s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 14:49

Target

5d62945e8c6f3fae4af389a10b4919480f23ae573df73f4a4296d84bf57abda0.exe
Size

562KB
MD5

ba5459b704abf8437c45c1a621bdc402
SHA1

2d8ac36114008b9e0d7b57f6ba85c0abc2b42d68
SHA256

5d62945e8c6f3fae4af389a10b4919480f23ae573df73f4a4296d84bf57abda0
SHA512

6c13d1e369976dbbb2d13fd15f724192ca7d059d54d50ffa156a39197f3526e67e883933fb9cf30c637d8b33d5efb2757ed5720df90ff9328aa71fa1762f2804
SSDEEP

12288:bCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMF3:bChqKgU79usbkx+VNJhofz765hx

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	5d62945e8c6f3fae4af389a10b4919480f23ae573df73f4a4296d84bf57abda0.exe

C:\Users\Admin\AppData\Local\Temp\5d62945e8c6f3fae4af389a10b4919480f23ae573df73f4a4296d84bf57abda0.exe
"C:\Users\Admin\AppData\Local\Temp\5d62945e8c6f3fae4af389a10b4919480f23ae573df73f4a4296d84bf57abda0.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1140

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1140-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1140-55-0x0000000074651000-0x0000000074653000-memory.dmp

Filesize
8KB

Download