69fc2c605ffc41b7d121426cc8a48421aa0f04915331d491cef3ad48b78cc3fa

Analysis

Target

3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe
Size

294KB
MD5

5455364b437d431400267a9092d65442
SHA1

e34ddbf5ba33ffff8beca910cb17237553f4bfd1
SHA256

3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd
SHA512

a00fcf59f67062b112139b0ecdb9a65b9e80b63f90a0dcccc088100e65086e91d1cf704e1e48ef6093e5dcbcb996c00d242792fef7aafe220bacf453251f9f0a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 816	528	3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe	29
PID 528 wrote to memory of 816	528	3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe	29
PID 528 wrote to memory of 816	528	3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe	29

C:\Users\Admin\AppData\Local\Temp\3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe
"C:\Users\Admin\AppData\Local\Temp\3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\start.bat" "
  2⤵
  PID:816

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/528-2-0x000007FEF6350000-0x000007FEF6CED000-memory.dmp

Filesize
9.6MB

Download
memory/528-3-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/528-4-0x000007FEF6350000-0x000007FEF6CED000-memory.dmp

Filesize
9.6MB

Download
memory/528-5-0x0000000000226000-0x0000000000245000-memory.dmp

Filesize
124KB

Download
memory/528-10-0x0000000000249000-0x000000000024A000-memory.dmp

Filesize
4KB

Download
memory/528-9-0x0000000000248000-0x0000000000249000-memory.dmp

Filesize
4KB

Download
memory/528-8-0x0000000000247000-0x0000000000248000-memory.dmp

Filesize
4KB

Download