1a108000c2628e79f722da53af1fe5bfe3ee8f415b8f0d822148d8cb62f1ccb9

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:35

Target

1a108000c2628e79f722da53af1fe5bfe3ee8f415b8f0d822148d8cb62f1ccb9.exe
Size

562KB
MD5

1ceae8dff0ac6675131621aca8f4ec9a
SHA1

3f8c3b1e5030b00edbe8df2ed1d9393a1c1f5d2e
SHA256

1a108000c2628e79f722da53af1fe5bfe3ee8f415b8f0d822148d8cb62f1ccb9
SHA512

c1efe53250cec43c5f80689120d0108f855598519118125b7cd92acd3398015fdef13c5d9c1d27f5fa507dd645fece77739c1e1c105602dc76f3c88089766d4f
SSDEEP

12288:DCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFZ:DChqKgU79usbkx+VNJhofz765hn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	1a108000c2628e79f722da53af1fe5bfe3ee8f415b8f0d822148d8cb62f1ccb9.exe

C:\Users\Admin\AppData\Local\Temp\1a108000c2628e79f722da53af1fe5bfe3ee8f415b8f0d822148d8cb62f1ccb9.exe
"C:\Users\Admin\AppData\Local\Temp\1a108000c2628e79f722da53af1fe5bfe3ee8f415b8f0d822148d8cb62f1ccb9.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1100

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1100-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1100-55-0x0000000074C41000-0x0000000074C43000-memory.dmp

Filesize
8KB

Download