258143ceb06109645428f8db76a3c7836e36d6620e370d7aa7daa816af80a796

Analysis

max time kernel
127s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05/03/2023, 09:39

Target

258143ceb06109645428f8db76a3c7836e36d6620e370d7aa7daa816af80a796.exe
Size

10.6MB
MD5

716ff6ef0dbfaeabf5bee6a7eb695cbf
SHA1

47eba7a6db4438e03e63e99975ff085513371a32
SHA256

258143ceb06109645428f8db76a3c7836e36d6620e370d7aa7daa816af80a796
SHA512

c1f3dc8adff48a142c176cd9c7ae223ca0e93c4ca60503e40314b51a1d6d9a1ede07f56c49e622198983897c66e6f5d07574f1913d53135dbbac258c8db11172
SSDEEP

196608:ed7CokN/Na67LORQG96sy4rR9OqGd/DF/95XoW7FbjqC3GkwOmL:edJk3N7ZGzy4F0tDf7FSp

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	258143ceb06109645428f8db76a3c7836e36d6620e370d7aa7daa816af80a796.exe

C:\Users\Admin\AppData\Local\Temp\258143ceb06109645428f8db76a3c7836e36d6620e370d7aa7daa816af80a796.exe
"C:\Users\Admin\AppData\Local\Temp\258143ceb06109645428f8db76a3c7836e36d6620e370d7aa7daa816af80a796.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2036

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact