392d2ed52b2d45b378edfeae9c83501195823940cfe97906fedca52d47474e7d

Analysis

max time kernel
42s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
13-01-2023 00:58

Target

392d2ed52b2d45b378edfeae9c83501195823940cfe97906fedca52d47474e7d.exe
Size

1.4MB
MD5

d52b8bb1928e6b4d33128475bbccb8f7
SHA1

bf8e2c3e3b0b09459fa52c8adf9de0d0d0f1a4c5
SHA256

392d2ed52b2d45b378edfeae9c83501195823940cfe97906fedca52d47474e7d
SHA512

43619976df0dab599ec6316cf304ee3720806839b48df5721e966160caa5d4e1bd4dd48ca9a953c163ce89cd3c8a3cc5d16c2b0cc7462723db927cb819bad440
SSDEEP

24576:ZRHvDseGJqNW5AhVAt058rCbc9g+ptUZit54rV9X8Tmhiif4:ZY058CbcW+XAimQmHQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1272	392d2ed52b2d45b378edfeae9c83501195823940cfe97906fedca52d47474e7d.exe

C:\Users\Admin\AppData\Local\Temp\392d2ed52b2d45b378edfeae9c83501195823940cfe97906fedca52d47474e7d.exe
"C:\Users\Admin\AppData\Local\Temp\392d2ed52b2d45b378edfeae9c83501195823940cfe97906fedca52d47474e7d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1272

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1272-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download