338bde64723cbdad590e6e06d93a731437e424cb3641a45790e8c6fc15939fb6

Analysis

max time kernel
176s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 15:19

Target

338bde64723cbdad590e6e06d93a731437e424cb3641a45790e8c6fc15939fb6.exe
Size

562KB
MD5

e505da003b620a8cd5c3eec8f3945f06
SHA1

69463a51cb988a437a6a95d144f45cfb60e37d45
SHA256

338bde64723cbdad590e6e06d93a731437e424cb3641a45790e8c6fc15939fb6
SHA512

74d7101d06c9a7e0a37d3403470a8d48710a5dfb838567efef598a457ed4d70bfe0b31ada7330a86f634ea8fecc9016c07d100c65fd7d794f51938163d3d9289
SSDEEP

12288:xCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFw+:xChqKgU79usbkx+VNJhofz765hj

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4524	338bde64723cbdad590e6e06d93a731437e424cb3641a45790e8c6fc15939fb6.exe

C:\Users\Admin\AppData\Local\Temp\338bde64723cbdad590e6e06d93a731437e424cb3641a45790e8c6fc15939fb6.exe
"C:\Users\Admin\AppData\Local\Temp\338bde64723cbdad590e6e06d93a731437e424cb3641a45790e8c6fc15939fb6.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4524

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact