69fc2c605ffc41b7d121426cc8a48421aa0f04915331d491cef3ad48b78cc3fa | Triage

Analysis

max time kernel
56s
max time network
106s
platform
windows10_x64
resource
win10v20201028
submitted
15-03-2021 09:51

Sharing

Report Analysis Logs

General

Target

3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe
Size

294KB
MD5

5455364b437d431400267a9092d65442
SHA1

e34ddbf5ba33ffff8beca910cb17237553f4bfd1
SHA256

3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd
SHA512

a00fcf59f67062b112139b0ecdb9a65b9e80b63f90a0dcccc088100e65086e91d1cf704e1e48ef6093e5dcbcb996c00d242792fef7aafe220bacf453251f9f0a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4764 wrote to memory of 508	4764	3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe	78
PID 4764 wrote to memory of 508	4764	3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe	78

C:\Users\Admin\AppData\Local\Temp\3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe
"C:\Users\Admin\AppData\Local\Temp\3ed5d687a46e865424395d3dd455f69c82ac0b22fa24f361db6e87e7aa5019bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\start.bat" "
  2⤵
  PID:508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4764-2-0x00007FF942880000-0x00007FF943220000-memory.dmp

Filesize
9.6MB

Download
memory/4764-3-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/4764-4-0x0000000002294000-0x0000000002295000-memory.dmp

Filesize
4KB

Download
memory/4764-7-0x000000000229A000-0x000000000229F000-memory.dmp

Filesize
20KB

Download