aa016222af172a530cfcf5ed6d301ba32013eac63a276f774ddc16e9cd8b3fa4

Analysis

max time kernel
169s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 08:27

Target

aa016222af172a530cfcf5ed6d301ba32013eac63a276f774ddc16e9cd8b3fa4.exe
Size

671KB
MD5

1b393127ce97b0d9404b976fa368b236
SHA1

74ecaf4edf694d813b67bca2655fb24bce793a9c
SHA256

aa016222af172a530cfcf5ed6d301ba32013eac63a276f774ddc16e9cd8b3fa4
SHA512

983f7bec76d8dd1413938d0bb2f143e4d18560861a5d0ca97d6e9845f6e2bf8820ee80f396e8673f6c83151e758fdbe46b8cdfccac47b2f19aadaab9e6ca9c72
SSDEEP

12288:aADvX5yYe8RZg2s2KY94/InekBi8MeRR4GDgyS9iAhwfp:HfU8g72/946JBiHeRR4Gk5rhwf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2200	aa016222af172a530cfcf5ed6d301ba32013eac63a276f774ddc16e9cd8b3fa4.exe

C:\Users\Admin\AppData\Local\Temp\aa016222af172a530cfcf5ed6d301ba32013eac63a276f774ddc16e9cd8b3fa4.exe
"C:\Users\Admin\AppData\Local\Temp\aa016222af172a530cfcf5ed6d301ba32013eac63a276f774ddc16e9cd8b3fa4.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2200

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact