3761fe3ccdc897f55ccf021c30c6d20e98199eb2e98bad526175bb5d8a4813a0

Analysis

max time kernel
246s
max time network
338s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:16

Target

3761fe3ccdc897f55ccf021c30c6d20e98199eb2e98bad526175bb5d8a4813a0.exe
Size

562KB
MD5

735cf58e02b0c9d6b14f38cf0c448e00
SHA1

d4754efe6582a4f772b861662d38b5bbbb72f443
SHA256

3761fe3ccdc897f55ccf021c30c6d20e98199eb2e98bad526175bb5d8a4813a0
SHA512

ab96071695c8a20f994d70c0534d707896e2b810502d833895e7d1e083913a2f407f971b3d10bd2762575b2eae39acd989574d4b06e097fd60eb97538a8b7494
SSDEEP

12288:zCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFk:zChqKgU79usbkx+VNJhofz765hy

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
268	3761fe3ccdc897f55ccf021c30c6d20e98199eb2e98bad526175bb5d8a4813a0.exe

C:\Users\Admin\AppData\Local\Temp\3761fe3ccdc897f55ccf021c30c6d20e98199eb2e98bad526175bb5d8a4813a0.exe
"C:\Users\Admin\AppData\Local\Temp\3761fe3ccdc897f55ccf021c30c6d20e98199eb2e98bad526175bb5d8a4813a0.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/268-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/268-55-0x0000000074491000-0x0000000074493000-memory.dmp

Filesize
8KB

Download