1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667

Analysis

max time kernel
91s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 05:59

Target

1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667.exe
Size

957KB
MD5

5f8de7ccc5e6c044632a1a6c720c2ac6
SHA1

141979864304f786e05e30a79254e15ee780e96b
SHA256

1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667
SHA512

2f04810b39c1d45eef6009e6a48de9d693c4d57661b46d5f23a85840ed4bbd73271813b5e2841309d0d9cc8983111157a6e67c6a03aacd4d8a0329d9be03bcb8
SSDEEP

24576:7Xof7FpafAQDL9y+sg9hYDeKc1s08f8sHi2mfj:zoxpSAQP9zeE1snf8X2m7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667.exe

pid	process
4928	1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667.exe
4928	1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667.exe

C:\Users\Admin\AppData\Local\Temp\1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667.exe
"C:\Users\Admin\AppData\Local\Temp\1d012d992193baef6c24184e8997344ae91d85e4ff38251e4ff118320b87e667.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4928

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact