9071787685b66e02837856d834411f2c15f23f3d82ab4a5f70d2186636ee3bee

Analysis

max time kernel
13s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 14:22

Target

9071787685b66e02837856d834411f2c15f23f3d82ab4a5f70d2186636ee3bee.exe
Size

41KB
MD5

e40ff2288e6ba96e747219bf0cf8136c
SHA1

ff0b082cfd24b9a6de17162ab049ea87b2c07311
SHA256

9071787685b66e02837856d834411f2c15f23f3d82ab4a5f70d2186636ee3bee
SHA512

8d617f6136fae1f00ae93f16cbde33098ece8532dab5129576bc41c8e22c3ff3a3157d17a3d1bdb52ccc8a003344df0767078b4f77d5c09e383fc2ddd42e1821
SSDEEP

384:/TwOmsVRor0i+uuxyA8qEV3uGCZYoS2bJUnyUDU2kknhu1jKnv7D3y:/8Om/kF0AQvLZSluU7mu1jKvC

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1496	9071787685b66e02837856d834411f2c15f23f3d82ab4a5f70d2186636ee3bee.exe

C:\Users\Admin\AppData\Local\Temp\9071787685b66e02837856d834411f2c15f23f3d82ab4a5f70d2186636ee3bee.exe
"C:\Users\Admin\AppData\Local\Temp\9071787685b66e02837856d834411f2c15f23f3d82ab4a5f70d2186636ee3bee.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1496

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1496-56-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download