483484a980de3e1754aa9dee7773a44d242f776cc525483d79d343a2dcceb344

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:05

Target

483484a980de3e1754aa9dee7773a44d242f776cc525483d79d343a2dcceb344.exe
Size

562KB
MD5

cd8a9639baf1cfd4f0a07b5c988704da
SHA1

83052b62335d65b443b284c729a32e2da9e3aefd
SHA256

483484a980de3e1754aa9dee7773a44d242f776cc525483d79d343a2dcceb344
SHA512

c7ce8f11b564c7c8bb9ffab1a2457543aa13ccb62332875087313675edc7ea3ce4d6ebae31a1a82d5835cbdd298c7d6d7d23dce63f717dcdbda985b02faf790a
SSDEEP

12288:TCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMF6j:TChqKgU79usbkx+VNJhofz765hs

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1596	483484a980de3e1754aa9dee7773a44d242f776cc525483d79d343a2dcceb344.exe

C:\Users\Admin\AppData\Local\Temp\483484a980de3e1754aa9dee7773a44d242f776cc525483d79d343a2dcceb344.exe
"C:\Users\Admin\AppData\Local\Temp\483484a980de3e1754aa9dee7773a44d242f776cc525483d79d343a2dcceb344.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1596

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1596-54-0x00000000767D1000-0x00000000767D3000-memory.dmp

Filesize
8KB

Download
memory/1596-55-0x0000000074E91000-0x0000000074E93000-memory.dmp

Filesize
8KB

Download