41e3db16157481bebd76ec859cf5d874b7378e8ea98c1839907c0ffe63ebbf39

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:09

Target

41e3db16157481bebd76ec859cf5d874b7378e8ea98c1839907c0ffe63ebbf39.exe
Size

562KB
MD5

9505c1846b2aeca363be3ccb5410cd19
SHA1

2b4c240f2b65afd8b3361875fe1d5d29737bf3d9
SHA256

41e3db16157481bebd76ec859cf5d874b7378e8ea98c1839907c0ffe63ebbf39
SHA512

9183099c573bb5fc47f48fe57ad110db34dd7515cd0b768cc4ca916c256fdf0364e3f893cadcb4f7a63939097bc838494f51480214cd99118c1089a0b9244809
SSDEEP

12288:rCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFe:rChqKgU79usbkx+VNJhofz765ho

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1324	41e3db16157481bebd76ec859cf5d874b7378e8ea98c1839907c0ffe63ebbf39.exe

C:\Users\Admin\AppData\Local\Temp\41e3db16157481bebd76ec859cf5d874b7378e8ea98c1839907c0ffe63ebbf39.exe
"C:\Users\Admin\AppData\Local\Temp\41e3db16157481bebd76ec859cf5d874b7378e8ea98c1839907c0ffe63ebbf39.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1324

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1324-55-0x0000000074A61000-0x0000000074A63000-memory.dmp

Filesize
8KB

Download