16dc31b5f3df6b0f97e69c582d43ebf9165febfe3576b14a5ac12812d5abeae1

Analysis

max time kernel
137s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 15:38

Target
16dc31b5f3df6b0f97e69c582d43ebf9165febfe3576b14a5ac12812d5abeae1.exe
Size 562KB
Sample221205-s231sada26
SHA256 16dc31b5f3df6b0f97e69c582d43ebf9165febfe3576b14a5ac12812d5abeae1
MD5 e71685d045a47e44ba8052754a28ec96
SHA1 d981581f612fa44f069d5dbbd9dce5f713458f27
SHA512 52a69a8767a6e53e8352b5bb579de0a9e989c47b3c605808455b349d587ab4d830c873f36be44b4218a5559ae6d552cd8d7efeb6b8bc6fc9f0faffd54d0accd9
SSDEEP 12288:bCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFB:bChqKgU79usbkx+VNJhofz765hT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4424	16dc31b5f3df6b0f97e69c582d43ebf9165febfe3576b14a5ac12812d5abeae1.exe

C:\Users\Admin\AppData\Local\Temp\16dc31b5f3df6b0f97e69c582d43ebf9165febfe3576b14a5ac12812d5abeae1.exe
"C:\Users\Admin\AppData\Local\Temp\16dc31b5f3df6b0f97e69c582d43ebf9165febfe3576b14a5ac12812d5abeae1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4424

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact