640f6fa7a32a694b0912bd9042ac043f7e1252cb28db7385a3c2060d327d32b7

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 02:37

Target

.exe/PreviousFilesRecovery.exe
Size

128KB
MD5

9e4c902e52d513e1437c599953ef7e1e
SHA1

e3ba3f445e47d971cf7b1b85c50634b8c79eea88
SHA256

2c749ebe67bfb2496b47d2bcd8b05e32134e71bcc51d0b1bf63b2dd668f56b5e
SHA512

9e5d58d526a9887faa706e223301a1b7f3bc14e309ae6d110f808874e3ad3ffd353a1aecd9c17be47bcb24881dd53460afd3189f78d9582825db10d46801b612
SSDEEP

3072:K5sQ7MuFeUtHBTOOmQI0WwhxUjg76FmaKJgf:BUMjUdlT2QlJe

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\.exe\PreviousFilesRecovery.exe
"C:\Users\Admin\AppData\Local\Temp\.exe\PreviousFilesRecovery.exe"
1⤵
PID:2516

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact