a54bd21ed8f76519f03a489030735439f289e5e35a912b46d27600f04a3d825d

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 00:17

Target

a54bd21ed8f76519f03a489030735439f289e5e35a912b46d27600f04a3d825d.exe
Size

114KB
MD5

f26df8dbd322ccb1ce51516a5d255cc9
SHA1

625a845b4c63ea7ac18d30936cfb24e7496a0fa3
SHA256

a54bd21ed8f76519f03a489030735439f289e5e35a912b46d27600f04a3d825d
SHA512

539ea326056bcbdd3369f16cf93f4c3cfa43207038760763331070b958d2b5c8c10771745c90fe72da349b225e31809b3649ad3fef734408f13987c636362254
SSDEEP

3072:qOhm8nrGPTkBF7yjaa4hilV1McTDLQZ9HEJac3:qOGTkBFya1hi1hLQ3Ev

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	a54bd21ed8f76519f03a489030735439f289e5e35a912b46d27600f04a3d825d.exe

C:\Users\Admin\AppData\Local\Temp\a54bd21ed8f76519f03a489030735439f289e5e35a912b46d27600f04a3d825d.exe
"C:\Users\Admin\AppData\Local\Temp\a54bd21ed8f76519f03a489030735439f289e5e35a912b46d27600f04a3d825d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4992-132-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/4992-133-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download