0be7fa9517508dd95e0dfeb057e7062dca7139a9de9f6a360a09b0d34cec61ed

Analysis

max time kernel
40s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:45

Target

0be7fa9517508dd95e0dfeb057e7062dca7139a9de9f6a360a09b0d34cec61ed.exe
Size

564KB
MD5

16b90498d80263d5c700a775c02492c7
SHA1

d3fd4149fa7a25f726b20b70b7f1690498badbd9
SHA256

0be7fa9517508dd95e0dfeb057e7062dca7139a9de9f6a360a09b0d34cec61ed
SHA512

2387e18294c220abcbb0d538b3aff04298be28fb4b6bc6a079d8be4cb014ee6e562c2a1ac3cce889506d234623727a3d9a4ec7c26c44122eebb85b0a8d1fc839
SSDEEP

12288:3GQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOALp:3/IdQ8KglrNYltim/GRJx8At

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
900	0be7fa9517508dd95e0dfeb057e7062dca7139a9de9f6a360a09b0d34cec61ed.exe

C:\Users\Admin\AppData\Local\Temp\0be7fa9517508dd95e0dfeb057e7062dca7139a9de9f6a360a09b0d34cec61ed.exe
"C:\Users\Admin\AppData\Local\Temp\0be7fa9517508dd95e0dfeb057e7062dca7139a9de9f6a360a09b0d34cec61ed.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/900-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x00000000745D1000-0x00000000745D3000-memory.dmp

Filesize
8KB

Download