5704c1908b6ddb1e868105a190fa65eee0fc7ae3ea2ecb4802d88acb814a8936

Analysis

max time kernel
163s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 14:54

Target

5704c1908b6ddb1e868105a190fa65eee0fc7ae3ea2ecb4802d88acb814a8936.exe
Size

562KB
MD5

b9543c00d38eaa9267e4fc4c2d872ec0
SHA1

1578ebbec97aea27cc6cfe96c53389abcebeedae
SHA256

5704c1908b6ddb1e868105a190fa65eee0fc7ae3ea2ecb4802d88acb814a8936
SHA512

6c3a03c6a7f2cf3985ae91505ea87381415c64cf6a2707cc462e5b001ab6785dae889ee347e458268d79091fe1881b840b292239508703f5c3886020ca8ce03e
SSDEEP

12288:bCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFW:bChqKgU79usbkx+VNJhofz765hM

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4268	5704c1908b6ddb1e868105a190fa65eee0fc7ae3ea2ecb4802d88acb814a8936.exe

C:\Users\Admin\AppData\Local\Temp\5704c1908b6ddb1e868105a190fa65eee0fc7ae3ea2ecb4802d88acb814a8936.exe
"C:\Users\Admin\AppData\Local\Temp\5704c1908b6ddb1e868105a190fa65eee0fc7ae3ea2ecb4802d88acb814a8936.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact