f3b400e443481f329974627ccb51eb8159adcbf5a7f6ce7c507cd7434f3e6d90

Analysis

max time kernel
127s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
17/03/2023, 07:29

Target

f3b400e443481f329974627ccb51eb8159adcbf5a7f6ce7c507cd7434f3e6d90.exe
Size

10.6MB
MD5

d3e5e1a874ef70373f363874cb6cb2ae
SHA1

6f115aa7518610c9ca82c81fcb0199449be649a8
SHA256

f3b400e443481f329974627ccb51eb8159adcbf5a7f6ce7c507cd7434f3e6d90
SHA512

76f92b2515b2b58e17d93fd4dd62a799a77b14b9a61dba3d67e0831b1dc633857fe32401f2b93a98dc71cb9aabe650d43934146c56bc7d1e1e2bb17295f4040c
SSDEEP

196608:o1ml4Ou5yJvPEcm8FDDZV5BapwKYo65ry9IaRzvQx9qKaYGPEjJoME00622Oft3:xl4wJvPnHDDZV5IOKQ5ry9IWYx9qK2IA

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1968	f3b400e443481f329974627ccb51eb8159adcbf5a7f6ce7c507cd7434f3e6d90.exe

C:\Users\Admin\AppData\Local\Temp\f3b400e443481f329974627ccb51eb8159adcbf5a7f6ce7c507cd7434f3e6d90.exe
"C:\Users\Admin\AppData\Local\Temp\f3b400e443481f329974627ccb51eb8159adcbf5a7f6ce7c507cd7434f3e6d90.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1968

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact