09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768

Resubmissions

16-09-2021 17:11

29-07-2020 07:17

Target

09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe
Size

64KB
MD5

aa0d25108c420b68af8a98d877a10e9a
SHA1

b4a9c79567a508254953a024ac284c12ce57873b
SHA256

09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768
SHA512

b00f2e9c3d1a343b257a423a5fdf9aa4be82b11b94657d2bd88c056da80b34903aa103c34eeca5e5cffab81d92e53c4209765f25cadab38cc0df049d2b1e07d2

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe

description	pid	process	target process
PID 108 wrote to memory of 1524	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	svchost.exe
PID 108 wrote to memory of 1524	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	svchost.exe
PID 108 wrote to memory of 1524	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	svchost.exe
PID 108 wrote to memory of 1524	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	svchost.exe
PID 108 wrote to memory of 1524	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	svchost.exe
PID 108 wrote to memory of 1508	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	iexplore.exe
PID 108 wrote to memory of 1508	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	iexplore.exe
PID 108 wrote to memory of 1508	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	iexplore.exe
PID 108 wrote to memory of 1508	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	iexplore.exe
PID 108 wrote to memory of 1508	108	09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe	iexplore.exe

C:\Users\Admin\AppData\Local\Temp\09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe
"C:\Users\Admin\AppData\Local\Temp\09a4b8050e81c0d265bb05d6ef4b7155d0ffda7ebe00820aa5a1fd08c3f4a768.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:108
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1524
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe"
  2⤵
  PID:1508

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact