361cecb9d60feae375d3ba996ba5e68c233723cb5b98332f9dd30c032833b7b2

Analysis

max time kernel
4264952s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
16/01/2022, 18:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
triage_dropped_file.exe
Size 232KB
Sample220116-w3q96afhd4
SHA256 361cecb9d60feae375d3ba996ba5e68c233723cb5b98332f9dd30c032833b7b2
MD5 04b0dabb9297a9a88feec4af0805aa22
SHA1 95725ba63b97192efdfe4751086b68ca3ab5fd2d
SHA512 0fb2503636ddf7b2555c1cb6fe505fc467f844d935d691b476dea4a5b5b81709be3467be7fd8255fa13978c0a501db1c42cca543b607f3ac300b34088816fa7a
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1536	triage_dropped_file.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1536 set thread context of 3296	1536	triage_dropped_file.exe	53

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53
PID 1536 wrote to memory of 3296	1536	triage_dropped_file.exe	53

C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
  "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
  2⤵
  PID:3296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3296-132-0x0000000000400000-0x00000000004A2000-memory.dmp

Download