5ca39e95cc0a2e37e09e761798594ab168cf60b97c4351e68d7c3e8ed739166a

Analysis

max time kernel
500s
max time network
502s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/12/2022, 23:52 UTC

Target

cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe.exe
Size

282KB
MD5

abae19910a144bbaa6da3f40ff3af52c
SHA1

b899b325e4c23d3d06dbbaae782dc68cfec5901e
SHA256

cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe
SHA512

96ab5a666b63fc7ad4a3b35301d1c42d2a34a084085aab360ad216f6db54b66207b1351f78036bae78188dfb2c6776101e91332402defae997a1e30aafc371c3
SSDEEP

6144:fTt0EBLlxZLDXVlgGDv8RnhKOLOlF/KlZE//n/W:JDRZLDrtjMnVOlF/QEH+

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe.exe
"C:\Users\Admin\AppData\Local\Temp\cdccb18c253e2a4a7a4fbe59d4d0ed43a26f1de5abf61f95aa3091f4d298a1fe.exe"
1⤵
PID:1776

No results found

No results found

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact