56a3a322eca6f37c99a453a05e7cca8b260eb97900eb93a9e6188f810f41d4a2

Analysis

max time kernel
9s
max time network
10s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
18/01/2022, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8871c3cc72ab3378479b80c4422f5c70.exe
Size 287KB
Sample220118-v4a4wscdbl
SHA256 56a3a322eca6f37c99a453a05e7cca8b260eb97900eb93a9e6188f810f41d4a2
MD5 8871c3cc72ab3378479b80c4422f5c70
SHA1 ae828e208c40894977cac8003f3b86c216c04377
SHA512 4dda411c1aeabd68fee776dad86389befcd3385dda398da0b9bf72839a76ca1cac8da57c257aff9b4c15ca7c120006074217b6dc9b8928228cc13ef7f90982e2
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3096	8871c3cc72ab3378479b80c4422f5c70.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3096 set thread context of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54
PID 3096 wrote to memory of 2200	3096	8871c3cc72ab3378479b80c4422f5c70.exe	54

C:\Users\Admin\AppData\Local\Temp\8871c3cc72ab3378479b80c4422f5c70.exe
"C:\Users\Admin\AppData\Local\Temp\8871c3cc72ab3378479b80c4422f5c70.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\8871c3cc72ab3378479b80c4422f5c70.exe
  "C:\Users\Admin\AppData\Local\Temp\8871c3cc72ab3378479b80c4422f5c70.exe"
  2⤵
  PID:2200

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-131-0x0000000000400000-0x00000000004A2000-memory.dmp

Download