be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd5600da2ff058a6af043

Analysis

Target
be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd.exe
Size 870KB
Sample210528-xe9mpfvgee
SHA256 be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd5600da2ff058a6af043
MD5 26dc9a5d8ee581177590d5d6471070f6
SHA1 28dc9d69721265ab4b273a7698765aced504dea3
SHA512 3d665339a2f0693a29b5d50cde0e54ac49c664b4c9b0d4b051b6b1027b6e62a34874e42b0fefa2ca316fe92adedb46fc052296e930b6f6a0fa81cd427f762115
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

pid	Process
2184	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 204	648	be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd.exe	78
PID 648 wrote to memory of 204	648	be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd.exe	78
PID 648 wrote to memory of 204	648	be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd.exe	78
PID 204 wrote to memory of 2184	204	cmd.exe	80
PID 204 wrote to memory of 2184	204	cmd.exe	80
PID 204 wrote to memory of 2184	204	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd.exe
"C:\Users\Admin\AppData\Local\Temp\be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\be8762ebc8287f7707ee50b5e769312f33e44deb3e8bd.exe & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\SysWOW64\PING.EXE
    ping 0
    3⤵
    - Runs ping.exe
    PID:2184

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact