ac2c2e2b67deca31d1f61ff956ef8b676fa733da9c682f26fbda28b46c6e6f63

Analysis

Target

setup(1).exe
Size

266KB
MD5

dcd1e195ad1945389bc4d87dae82a164
SHA1

7c1aed93371a31888752afd9bfc7d76379940732
SHA256

ac2c2e2b67deca31d1f61ff956ef8b676fa733da9c682f26fbda28b46c6e6f63
SHA512

52f2de83f7286655a1cb964fa76704ede980d875571d424689253757c6ec9491d25402ce9124ec825f15e3e62f4bb1b43b2675c49757b1c00e179d69a03e345b

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2236 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2236 taskkill.exe

pid	process
2236	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2236	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

setup(1).execmd.exe

description	pid	process	target process
PID 1196 wrote to memory of 632	1196	setup(1).exe	cmd.exe
PID 1196 wrote to memory of 632	1196	setup(1).exe	cmd.exe
PID 1196 wrote to memory of 632	1196	setup(1).exe	cmd.exe
PID 632 wrote to memory of 2236	632	cmd.exe	taskkill.exe
PID 632 wrote to memory of 2236	632	cmd.exe	taskkill.exe
PID 632 wrote to memory of 2236	632	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\setup(1).exe
"C:\Users\Admin\AppData\Local\Temp\setup(1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "setup(1).exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\setup(1).exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:632

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/632-114-0x0000000000000000-mapping.dmp

Download
memory/1196-116-0x0000000003DC0000-0x0000000003DEE000-memory.dmp

Filesize
184KB

Download
memory/1196-117-0x0000000000400000-0x0000000003DA4000-memory.dmp

Filesize
57.6MB

Download
memory/2236-115-0x0000000000000000-mapping.dmp

Download