015049bfe6ab2e38da33bce43d4a9bc876f5b791dccd8d16974dedbb00600aa4

Analysis

max time kernel
118s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04-03-2023 11:11

Target

015049bfe6ab2e38da33bce43d4a9bc876f5b791dccd8d16974dedbb00600aa4.exe
Size

10.5MB
MD5

5dca008b7403786bb7940d6c1fafab28
SHA1

2d4f6b9340d1963b0a8897cf15fed6a2542ea0ea
SHA256

015049bfe6ab2e38da33bce43d4a9bc876f5b791dccd8d16974dedbb00600aa4
SHA512

0cfc67f8b6b6eaa6a83be4a45beaaf48ca743cc43fd5011eb18d2a1679ea676911ece6bf0425381efc081585ba951299f823b0bb6bd4b1212af692c67c0f6eb1
SSDEEP

196608:Ijm8vpzac3VM87eezk5gGZXEDqfouRi+CgF8GCtGEzv9ex+QXmtkKy9b:IjPphM8CV5qufPj8Giv1O5mt54

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1980	015049bfe6ab2e38da33bce43d4a9bc876f5b791dccd8d16974dedbb00600aa4.exe

C:\Users\Admin\AppData\Local\Temp\015049bfe6ab2e38da33bce43d4a9bc876f5b791dccd8d16974dedbb00600aa4.exe
"C:\Users\Admin\AppData\Local\Temp\015049bfe6ab2e38da33bce43d4a9bc876f5b791dccd8d16974dedbb00600aa4.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1980

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact