09ee51377ad41d75fe39ba4b963598b584900321a914f5b077715fb448f86ad4

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:46

Target

09ee51377ad41d75fe39ba4b963598b584900321a914f5b077715fb448f86ad4.exe
Size

562KB
MD5

4d0ed2cef38e852f1615e7f8e0cf66e1
SHA1

0914859385491dd0eab5c02b8c93f6267866cdc5
SHA256

09ee51377ad41d75fe39ba4b963598b584900321a914f5b077715fb448f86ad4
SHA512

19197e37ac23be1465671f224afd65fb5555fed238f0b59cb97851b9c38db840af3d32a687948e689062f225742a9a504050bc5472e8fdd2e82a89b4c0c4194f
SSDEEP

12288:DCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFs9:DChqKgU79usbkx+VNJhofz765h8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1248	09ee51377ad41d75fe39ba4b963598b584900321a914f5b077715fb448f86ad4.exe

C:\Users\Admin\AppData\Local\Temp\09ee51377ad41d75fe39ba4b963598b584900321a914f5b077715fb448f86ad4.exe
"C:\Users\Admin\AppData\Local\Temp\09ee51377ad41d75fe39ba4b963598b584900321a914f5b077715fb448f86ad4.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1248

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1248-54-0x0000000075351000-0x0000000075353000-memory.dmp

Filesize
8KB

Download
memory/1248-55-0x0000000074731000-0x0000000074733000-memory.dmp

Filesize
8KB

Download