95ed00b24e19383883157b6bdd36fb9dc9fc38f3b932e413673d96aa19aa4e99

Analysis

max time kernel
306s
max time network
395s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 03:04

Target

95ed00b24e19383883157b6bdd36fb9dc9fc38f3b932e413673d96aa19aa4e99.exe
Size

280KB
MD5

0fea2c8430537a829f4a815ce741cdb0
SHA1

42a1554cee407c7f9168111b6177a919ec0edde4
SHA256

95ed00b24e19383883157b6bdd36fb9dc9fc38f3b932e413673d96aa19aa4e99
SHA512

285770bc9d99706bb882c8bddfa58ba43f9ca398c79a21b13c91044e1c93273e469da06f8696420f9f83ad0d567482b601b7af82e2fd5c95c09d15dc88d7807d
SSDEEP

6144:KI+IpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNc/W:IuydfiebOiW

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2292	95ed00b24e19383883157b6bdd36fb9dc9fc38f3b932e413673d96aa19aa4e99.exe

C:\Users\Admin\AppData\Local\Temp\95ed00b24e19383883157b6bdd36fb9dc9fc38f3b932e413673d96aa19aa4e99.exe
"C:\Users\Admin\AppData\Local\Temp\95ed00b24e19383883157b6bdd36fb9dc9fc38f3b932e413673d96aa19aa4e99.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2292

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact