397b6f52ee13ce322a3adb2b1a9947484c78e88c43ec1fc55a01df68bcda9d83

Analysis

max time kernel
4s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 15:15

Target

397b6f52ee13ce322a3adb2b1a9947484c78e88c43ec1fc55a01df68bcda9d83.exe
Size

562KB
MD5

1fb9fbab59f0692b4adea17d155367d4
SHA1

e90dca674c916959b6f19a3df5cd2a01db18e046
SHA256

397b6f52ee13ce322a3adb2b1a9947484c78e88c43ec1fc55a01df68bcda9d83
SHA512

23bb4d074b9fdf8721cdea9887bb7f917b5b76a1578fee4b672642f763a2861945adb5196d1e22f1864064ac4983bf48d0819b80e5f2ac65224ef4ad1397ea75
SSDEEP

12288:DCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFJ:DChqKgU79usbkx+VNJhofz765h7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1224	397b6f52ee13ce322a3adb2b1a9947484c78e88c43ec1fc55a01df68bcda9d83.exe

C:\Users\Admin\AppData\Local\Temp\397b6f52ee13ce322a3adb2b1a9947484c78e88c43ec1fc55a01df68bcda9d83.exe
"C:\Users\Admin\AppData\Local\Temp\397b6f52ee13ce322a3adb2b1a9947484c78e88c43ec1fc55a01df68bcda9d83.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1224

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1224-54-0x0000000075C41000-0x0000000075C43000-memory.dmp

Filesize
8KB

Download
memory/1224-55-0x0000000074D31000-0x0000000074D33000-memory.dmp

Filesize
8KB

Download