573170a96bddb2f8249a83e5ebeec59fb103b11d148b1326377644db2d631db9

Analysis

max time kernel
240s
max time network
332s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 14:54

Target

573170a96bddb2f8249a83e5ebeec59fb103b11d148b1326377644db2d631db9.exe
Size

562KB
MD5

82af8e06aa1ea77d12906b29d174ac35
SHA1

29049e5fe410676eef55ee6b78a0ee9f77856677
SHA256

573170a96bddb2f8249a83e5ebeec59fb103b11d148b1326377644db2d631db9
SHA512

056173e767a84a73f80f907b48e2bc81632acab64c94dc27ddb39dbb9eb96404634516dd5be5e61ceadfcfe047a2de9b618f10ddca7789851c7c23d8599bac96
SSDEEP

12288:sCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFct:sChqKgU79usbkx+VNJhofz765hA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
672	573170a96bddb2f8249a83e5ebeec59fb103b11d148b1326377644db2d631db9.exe

C:\Users\Admin\AppData\Local\Temp\573170a96bddb2f8249a83e5ebeec59fb103b11d148b1326377644db2d631db9.exe
"C:\Users\Admin\AppData\Local\Temp\573170a96bddb2f8249a83e5ebeec59fb103b11d148b1326377644db2d631db9.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:672

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/672-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/672-55-0x0000000074751000-0x0000000074753000-memory.dmp

Filesize
8KB

Download