1acdaf7708c8d844db4a6374b1b0841118d6edf685399917fe448095a7fc7ff2

Analysis

max time kernel
56s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 15:34

Target

1acdaf7708c8d844db4a6374b1b0841118d6edf685399917fe448095a7fc7ff2.exe
Size

564KB
MD5

68b9246aac899d8516e5f0ab94ae73d5
SHA1

82451fffd339080bdd49f446d6017b59e90ba694
SHA256

1acdaf7708c8d844db4a6374b1b0841118d6edf685399917fe448095a7fc7ff2
SHA512

7a2a457f2f4908b0ca73b8203683621e288317a3a7b6142073dbe3297ad1bc0436fa6811b257a0f0d1cba400765011950cf013d78449b3f47ca0e8e7b4dfe3b0
SSDEEP

12288:3GQlIdQ8lIglrNYlPGAHQlmKgGRPcIxWcOAk:3/IdQ8KglrNYltim/GRJx8Ak

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	1acdaf7708c8d844db4a6374b1b0841118d6edf685399917fe448095a7fc7ff2.exe

C:\Users\Admin\AppData\Local\Temp\1acdaf7708c8d844db4a6374b1b0841118d6edf685399917fe448095a7fc7ff2.exe
"C:\Users\Admin\AppData\Local\Temp\1acdaf7708c8d844db4a6374b1b0841118d6edf685399917fe448095a7fc7ff2.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1664

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1664-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000074551000-0x0000000074553000-memory.dmp

Filesize
8KB

Download