145fc957b5515ee28a012da3ad5be8539c7eb088ecbfe1d747b36149a64c1e2d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:40

Target

145fc957b5515ee28a012da3ad5be8539c7eb088ecbfe1d747b36149a64c1e2d.exe
Size

562KB
MD5

2abf7e0f11a374995185091809eb8618
SHA1

b92b9c5b85b3bbee9d00b7d67c99fca557859003
SHA256

145fc957b5515ee28a012da3ad5be8539c7eb088ecbfe1d747b36149a64c1e2d
SHA512

3be9621ff2a95442e29d835845cd0e84195adb15a2f081e7809afc0b30605548f861c3d49dbe55bc579ae20bff689ff896d138adb8d65d2a59ff6c4dbe9c9189
SSDEEP

12288:cCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFs5:cChqKgU79usbkx+VNJhofz765hQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	145fc957b5515ee28a012da3ad5be8539c7eb088ecbfe1d747b36149a64c1e2d.exe

C:\Users\Admin\AppData\Local\Temp\145fc957b5515ee28a012da3ad5be8539c7eb088ecbfe1d747b36149a64c1e2d.exe
"C:\Users\Admin\AppData\Local\Temp\145fc957b5515ee28a012da3ad5be8539c7eb088ecbfe1d747b36149a64c1e2d.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1964

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1964-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1964-55-0x00000000748B1000-0x00000000748B3000-memory.dmp

Filesize
8KB

Download