8392408d685d10ddf024a7e4f47976e03a00fd787bd4ee0932766c4b9b278bc0

Analysis

max time kernel
10s
max time network
14s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19/01/2022, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02e260d43fa91e067838b68b19435124.exe
Size 296KB
Sample220119-wys8ysccd7
SHA256 8392408d685d10ddf024a7e4f47976e03a00fd787bd4ee0932766c4b9b278bc0
MD5 02e260d43fa91e067838b68b19435124
SHA1 a5797d5e51d8d30da1efc9b01ff0b42359ae19eb
SHA512 93042c891b4b6944f91621c2d1c5221f2ed9beb088b2a570e1a7ae987a5dbc3be94ffe5113f8ce03cfe639d3d0b91b23a25c4065ec7d22c886ae35432480a8c3
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3264	02e260d43fa91e067838b68b19435124.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3264 set thread context of 2040	3264	02e260d43fa91e067838b68b19435124.exe	54

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2040	3264	02e260d43fa91e067838b68b19435124.exe	54
PID 3264 wrote to memory of 2040	3264	02e260d43fa91e067838b68b19435124.exe	54
PID 3264 wrote to memory of 2040	3264	02e260d43fa91e067838b68b19435124.exe	54
PID 3264 wrote to memory of 2040	3264	02e260d43fa91e067838b68b19435124.exe	54
PID 3264 wrote to memory of 2040	3264	02e260d43fa91e067838b68b19435124.exe	54
PID 3264 wrote to memory of 2040	3264	02e260d43fa91e067838b68b19435124.exe	54

C:\Users\Admin\AppData\Local\Temp\02e260d43fa91e067838b68b19435124.exe
"C:\Users\Admin\AppData\Local\Temp\02e260d43fa91e067838b68b19435124.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Users\Admin\AppData\Local\Temp\02e260d43fa91e067838b68b19435124.exe
  "C:\Users\Admin\AppData\Local\Temp\02e260d43fa91e067838b68b19435124.exe"
  2⤵
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-131-0x0000000000400000-0x000000000042F000-memory.dmp

Download