f1fa4ab761e23c1b46ef59b9376fed1c1611c8ce6044333fdc9f00fdadf5c5e6

Analysis

max time kernel
46s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/01/2023, 18:21

Target

f1fa4ab761e23c1b46ef59b9376fed1c1611c8ce6044333fdc9f00fdadf5c5e6.exe
Size

5.6MB
MD5

8376ede150dc48daa4b20e5f76e57b7d
SHA1

eacbdaa6168742a98227d33e9ec0ac5a901dc85c
SHA256

f1fa4ab761e23c1b46ef59b9376fed1c1611c8ce6044333fdc9f00fdadf5c5e6
SHA512

b5bf40ec8bd69957fdb30be26f3add8468b6bf8f5ccc952915e830ea8884fb44883fa00d44f896a1f66921ccacd92472a3a9ba3147c14205c2ec24606456fd04
SSDEEP

98304:kuxQ8uG7dyZIMUvV5Tufnaf/+VfEalfTwmlro/BhzlzrbPlynV/2Z3WJzhXhNBrz:o8JYIMoZHuLwpLzrzlWOZmrhNBUs

Score

4^/10

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\test.txt	f1fa4ab761e23c1b46ef59b9376fed1c1611c8ce6044333fdc9f00fdadf5c5e6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f1fa4ab761e23c1b46ef59b9376fed1c1611c8ce6044333fdc9f00fdadf5c5e6.exe
"C:\Users\Admin\AppData\Local\Temp\f1fa4ab761e23c1b46ef59b9376fed1c1611c8ce6044333fdc9f00fdadf5c5e6.exe"
1⤵
- Drops file in Program Files directory
PID:1264

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1264-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download