cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d

Analysis

Target

cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe
Size

253KB
MD5

2b42a9613d2132e3fcc1f7fbac390b24
SHA1

adb4bf1e2d2085f0ee54e467fdeba042c2276964
SHA256

cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d
SHA512

e60c2b318ed699cdc75eace766e4d570a8809fe7b9f64eb0e4a4141d10179b282c97f330965f5a0b99019abe7326665dbfbe36de2f60a2933bf8eadaae727c01

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

644 timeout.exe
420 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe

description pid process

Token: SeDebugPrivilege 2672 cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe

pid	process
644	timeout.exe
420	timeout.exe

description	pid	process
Token: SeDebugPrivilege	2672	cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.execmd.execmd.exe

description	pid	process	target process
PID 2672 wrote to memory of 3440	2672	cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe	cmd.exe
PID 2672 wrote to memory of 3440	2672	cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe	cmd.exe
PID 2672 wrote to memory of 3440	2672	cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe	cmd.exe
PID 3440 wrote to memory of 644	3440	cmd.exe	timeout.exe
PID 3440 wrote to memory of 644	3440	cmd.exe	timeout.exe
PID 3440 wrote to memory of 644	3440	cmd.exe	timeout.exe
PID 2672 wrote to memory of 1352	2672	cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe	cmd.exe
PID 2672 wrote to memory of 1352	2672	cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe	cmd.exe
PID 2672 wrote to memory of 1352	2672	cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d.exe	cmd.exe
PID 1352 wrote to memory of 420	1352	cmd.exe	timeout.exe
PID 1352 wrote to memory of 420	1352	cmd.exe	timeout.exe
PID 1352 wrote to memory of 420	1352	cmd.exe	timeout.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C timeout 10
2⤵
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C timeout 10
2⤵
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:420

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/2672-118-0x0000000000A90000-0x0000000000AD4000-memory.dmp

Filesize
272KB

Download
memory/2672-119-0x0000000005730000-0x0000000005C2E000-memory.dmp

Filesize
5.0MB

Download
memory/2672-120-0x0000000005230000-0x000000000572E000-memory.dmp

Filesize
5.0MB

Download