8daecb6f790f586f5b312ba537cb64c099ad8cab4bce5878cc24ecf762e52360

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 21:19

Target

8daecb6f790f586f5b312ba537cb64c099ad8cab4bce5878cc24ecf762e52360.exe
Size

32KB
MD5

46353bc5e11701b9c747658f8fca4e40
SHA1

ec0f3e21913b027aa6c305f2300bc0c5a773dbef
SHA256

8daecb6f790f586f5b312ba537cb64c099ad8cab4bce5878cc24ecf762e52360
SHA512

1bb35794eefd7e005a97505703d82cab115bde3cd50b8057b2e614bf159f6b68fd564d383c19df7cb8b48b4b315cf7ed18c7c214260ffd27ce07d132c2e27bcf
SSDEEP

384:bn6UEiJ+EBGEohpXngSWln5ZuEj8TCW4M:76UEiJvsvWlnLR8TCW4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1344	8daecb6f790f586f5b312ba537cb64c099ad8cab4bce5878cc24ecf762e52360.exe

C:\Users\Admin\AppData\Local\Temp\8daecb6f790f586f5b312ba537cb64c099ad8cab4bce5878cc24ecf762e52360.exe
"C:\Users\Admin\AppData\Local\Temp\8daecb6f790f586f5b312ba537cb64c099ad8cab4bce5878cc24ecf762e52360.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1344-56-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1344-57-0x0000000074761000-0x0000000074763000-memory.dmp

Filesize
8KB

Download