9433599594b5cbebb9d6f31b4b7497d030aba445a05e5d0a26bd6fefdb6ed552

Analysis

max time kernel
70s
max time network
273s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:36

Target

9433599594b5cbebb9d6f31b4b7497d030aba445a05e5d0a26bd6fefdb6ed552.exe
Size

638KB
MD5

1ca9297f46c558927423504efbb440fd
SHA1

a70dc5e1140181af7ef60cd6dd61faac49d06c5e
SHA256

9433599594b5cbebb9d6f31b4b7497d030aba445a05e5d0a26bd6fefdb6ed552
SHA512

09e8c9191fe554eb77de4d698d19516f0021adf2e9704541420fd182fab5d43f1706a12423b3c96baa3a0509090f8bc2222a3a0d4ddd59f4d454f1bf2b01fabc
SSDEEP

12288:0uudWYcGL//JWM01Vfby4QQvRO4mqPeQ9HXD4AQfy3pxp7JExG4MuMMT+Mp4I:0ueWYT/hmflRBmqPeQ93D4AQq3vNJuGo

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	9433599594b5cbebb9d6f31b4b7497d030aba445a05e5d0a26bd6fefdb6ed552.exe

C:\Users\Admin\AppData\Local\Temp\9433599594b5cbebb9d6f31b4b7497d030aba445a05e5d0a26bd6fefdb6ed552.exe
"C:\Users\Admin\AppData\Local\Temp\9433599594b5cbebb9d6f31b4b7497d030aba445a05e5d0a26bd6fefdb6ed552.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1096

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1096-54-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/1096-55-0x0000000074DD1000-0x0000000074DD3000-memory.dmp

Filesize
8KB

Download