2d3d0c84b3643ef0ee8969c57ee4d55c3da066c7d4c2aa8619e98e9d7750c804

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 15:23

Target

2d3d0c84b3643ef0ee8969c57ee4d55c3da066c7d4c2aa8619e98e9d7750c804.exe
Size

562KB
MD5

a1a6c11d303a039c873bae47c58c5ae7
SHA1

d21a6df30c2b8dab9fec382e5d8bfd2175bf31f9
SHA256

2d3d0c84b3643ef0ee8969c57ee4d55c3da066c7d4c2aa8619e98e9d7750c804
SHA512

799ed8da057f157a73e163c2afdbef88f0c22def6e391c3e51b4c9ab52ef042c3ce2bffe977da4e19fce989ca6f255b2ae4a194d6af46a8d405df669357bc015
SSDEEP

12288:rCK+qK4QIUJ6ItO49LpwEBXu+OKex+VwKDPFIihoGqz765OMFU:rChqKgU79usbkx+VNJhofz765hq

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	2d3d0c84b3643ef0ee8969c57ee4d55c3da066c7d4c2aa8619e98e9d7750c804.exe

C:\Users\Admin\AppData\Local\Temp\2d3d0c84b3643ef0ee8969c57ee4d55c3da066c7d4c2aa8619e98e9d7750c804.exe
"C:\Users\Admin\AppData\Local\Temp\2d3d0c84b3643ef0ee8969c57ee4d55c3da066c7d4c2aa8619e98e9d7750c804.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1996

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1996-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1996-55-0x0000000074061000-0x0000000074063000-memory.dmp

Filesize
8KB

Download