55f424d154774b5cb321ba782e36ccdba48d8be6af8c16f722d6a51e7416bed2

Analysis

max time kernel
28s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:55

Target

55f424d154774b5cb321ba782e36ccdba48d8be6af8c16f722d6a51e7416bed2.exe
Size

562KB
MD5

87bd0746fe46633bef671eddc0e4b0ad
SHA1

ebc3008914a216250a6f5f067888b91f5108aa69
SHA256

55f424d154774b5cb321ba782e36ccdba48d8be6af8c16f722d6a51e7416bed2
SHA512

7e11e427d77115ae304d061edba933b9694a027cfc146c7ae92a4220a5858c7c40b5417c6b84e2a09508d5925e6f211f989819dfb30e82ac507668edb6e87be9
SSDEEP

12288:LCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFjf:LChqKgU79usbkx+VNJhofz765hl

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	55f424d154774b5cb321ba782e36ccdba48d8be6af8c16f722d6a51e7416bed2.exe

C:\Users\Admin\AppData\Local\Temp\55f424d154774b5cb321ba782e36ccdba48d8be6af8c16f722d6a51e7416bed2.exe
"C:\Users\Admin\AppData\Local\Temp\55f424d154774b5cb321ba782e36ccdba48d8be6af8c16f722d6a51e7416bed2.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1664

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1664-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000074741000-0x0000000074743000-memory.dmp

Filesize
8KB

Download