4e35118cbec4c5ed94fb3fdff47420fe5f075795775fa672182494d1baf2b7f3

Analysis

max time kernel
76s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:01

Target

4e35118cbec4c5ed94fb3fdff47420fe5f075795775fa672182494d1baf2b7f3.exe
Size

562KB
MD5

f3ba89af4715784c8d30ec307aaf56e1
SHA1

eb0db1ea596f002029f9b6a8a7f833816a436d29
SHA256

4e35118cbec4c5ed94fb3fdff47420fe5f075795775fa672182494d1baf2b7f3
SHA512

e17275c678f57db4925c7169c2224f1a8cba32b1d185301e125f98cab327ec72be11b004743598eae9957cf36bfef57ab51e44fe03e35381bf8eb97fc823a003
SSDEEP

12288:LCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMF3:LChqKgU79usbkx+VNJhofz765hJ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1572	4e35118cbec4c5ed94fb3fdff47420fe5f075795775fa672182494d1baf2b7f3.exe

C:\Users\Admin\AppData\Local\Temp\4e35118cbec4c5ed94fb3fdff47420fe5f075795775fa672182494d1baf2b7f3.exe
"C:\Users\Admin\AppData\Local\Temp\4e35118cbec4c5ed94fb3fdff47420fe5f075795775fa672182494d1baf2b7f3.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1572

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1572-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1572-55-0x0000000074251000-0x0000000074253000-memory.dmp

Filesize
8KB

Download