oblique | 7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a

Analysis

Target
7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe
Size 498KB
Sample210514-6ybmvbvk8x
SHA256 7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a
MD5 d24f971437f93caf9e6497f7ece0ce1c
SHA1 224a2aab2aba68c5635b0ea3b68512551bc0a055
SHA512 1dfa91aa466381bfca283f556e68754bb8445bc199c270d362d033cd86705f4e1a86f4b514128502a61b2285e3e68b9b35a45eec83321cb0f69663990ab116ed
MD5 SHA1 SHA512

Score

10^/10

oblique trojan

Executes dropped EXE 2 IoCs

pid	Process
1128	lphsi.exe
1372	hrss.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\script.lnk	hrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 1128	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	75
PID 3176 wrote to memory of 1128	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	75
PID 3176 wrote to memory of 1128	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	75
PID 3176 wrote to memory of 1372	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	76
PID 3176 wrote to memory of 1372	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	76
PID 3176 wrote to memory of 1372	3176	7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe	76

C:\Users\Admin\AppData\Local\Temp\7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe
"C:\Users\Admin\AppData\Local\Temp\7f15302860082e1a580961f72519fd50d29a1c89f08b2a8d7182059690f6be2a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Public\Video\lphsi.exe
  "C:\Users\Public\Video\lphsi.exe"
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Users\Public\Video\hrss.exe
  "C:\Users\Public\Video\hrss.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  PID:1372

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact