0f7cdde232401adecfc879e6b54d901d7b74d076ddd59c7aba3f2a54324013fe

Analysis

max time kernel
41s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:43

Target

0f7cdde232401adecfc879e6b54d901d7b74d076ddd59c7aba3f2a54324013fe.exe
Size

562KB
MD5

6452bb8bb3db632076b0cd7e8548bed5
SHA1

473d07dd6d82af49e09a74d292a74d562cf12fc0
SHA256

0f7cdde232401adecfc879e6b54d901d7b74d076ddd59c7aba3f2a54324013fe
SHA512

24bda669d8d8ae7cbd3b310c2a488323f11605765d49fdf12cca5d5153af2a8ec6cf1e0b1f5530c06c1c667e2373ceb0c2f2513a7e997cfc8cbca7aeb4368eab
SSDEEP

12288:bCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFm:bChqKgU79usbkx+VNJhofz765hA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	0f7cdde232401adecfc879e6b54d901d7b74d076ddd59c7aba3f2a54324013fe.exe

C:\Users\Admin\AppData\Local\Temp\0f7cdde232401adecfc879e6b54d901d7b74d076ddd59c7aba3f2a54324013fe.exe
"C:\Users\Admin\AppData\Local\Temp\0f7cdde232401adecfc879e6b54d901d7b74d076ddd59c7aba3f2a54324013fe.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1760

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1760-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x0000000074361000-0x0000000074363000-memory.dmp

Filesize
8KB

Download