0e568f8920a068d8300b2ef9096c8394cfa77b6002be1692ad3a6fead7e3eb1f

Analysis

Target

0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe
Size

383KB
MD5

4e99138abad19c9cba519e39083831c5
SHA1

2970b1d625f2e4ea946b70f9b6d6e26021f9bfbb
SHA256

0e568f8920a068d8300b2ef9096c8394cfa77b6002be1692ad3a6fead7e3eb1f
SHA512

9eccf430b186ad0494a84633009dc5687eba49eb19546f062abaea42e65e905c8115b3378a08f25ee6a931583d9f4e137f65255eca65d83947c7b3811e719e5d

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1276 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1296 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1296 taskkill.exe

pid	process
1276	cmd.exe

pid	process
1296	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1296	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.execmd.exe

description	pid	process	target process
PID 916 wrote to memory of 1276	916	0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe	cmd.exe
PID 916 wrote to memory of 1276	916	0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe	cmd.exe
PID 916 wrote to memory of 1276	916	0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe	cmd.exe
PID 916 wrote to memory of 1276	916	0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe	cmd.exe
PID 1276 wrote to memory of 1296	1276	cmd.exe	taskkill.exe
PID 1276 wrote to memory of 1296	1276	cmd.exe	taskkill.exe
PID 1276 wrote to memory of 1296	1276	cmd.exe	taskkill.exe
PID 1276 wrote to memory of 1296	1276	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe
"C:\Users\Admin\AppData\Local\Temp\0e568f8920a068d8300b2ef9096c8394cfa77b6002be1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:916

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/916-60-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/916-64-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/916-63-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/1276-61-0x0000000000000000-mapping.dmp

Download
memory/1296-62-0x0000000000000000-mapping.dmp

Download