4f2f4ad61f32711ce6f1296be3eb91f3bfd396d14fa439867ad80c05f902303f

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:00

Target

4f2f4ad61f32711ce6f1296be3eb91f3bfd396d14fa439867ad80c05f902303f.exe
Size

562KB
MD5

35e6619783dfd19427a14bbf07f458ff
SHA1

d4862ca7ba21fcaacafd10623642d05fe51509f0
SHA256

4f2f4ad61f32711ce6f1296be3eb91f3bfd396d14fa439867ad80c05f902303f
SHA512

953e98910a8b18e6837ce375e6bb014b112dbb0973ae30fc328936fd8b39de6f12d4150030bc072b724fa1d088f15ecd64e77f77a200c23c275e013d37f62075
SSDEEP

12288:zCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFXX:zChqKgU79usbkx+VNJhofz765hZ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1480	4f2f4ad61f32711ce6f1296be3eb91f3bfd396d14fa439867ad80c05f902303f.exe

C:\Users\Admin\AppData\Local\Temp\4f2f4ad61f32711ce6f1296be3eb91f3bfd396d14fa439867ad80c05f902303f.exe
"C:\Users\Admin\AppData\Local\Temp\4f2f4ad61f32711ce6f1296be3eb91f3bfd396d14fa439867ad80c05f902303f.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1480

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1480-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Filesize
8KB

Download
memory/1480-55-0x0000000074471000-0x0000000074473000-memory.dmp

Filesize
8KB

Download