6851b72e0bfaf608294bcac6ffef07e5e6591aee8b94ce9afad46b6e6cc32a59

Resubmissions

27-10-2021 14:44

27-10-2021 14:28

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Wed09abf83d9c2.exe

description	pid	process	target process
PID 524 wrote to memory of 572	524	Wed09abf83d9c2.exe	Wed09abf83d9c2.exe
PID 524 wrote to memory of 572	524	Wed09abf83d9c2.exe	Wed09abf83d9c2.exe
PID 524 wrote to memory of 572	524	Wed09abf83d9c2.exe	Wed09abf83d9c2.exe
PID 524 wrote to memory of 572	524	Wed09abf83d9c2.exe	Wed09abf83d9c2.exe

C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer\Wed09abf83d9c2.exe" -u
2⤵
PID:572

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/524-54-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download
memory/572-55-0x0000000000000000-mapping.dmp

Download