cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d

Analysis

Target

2b42a9613d2132e3fcc1f7fbac390b24.exe
Size

253KB
MD5

2b42a9613d2132e3fcc1f7fbac390b24
SHA1

adb4bf1e2d2085f0ee54e467fdeba042c2276964
SHA256

cce1cf601e23728f6783f55bbe926ef4be018bbaf2c65698423e347fcdd9778d
SHA512

e60c2b318ed699cdc75eace766e4d570a8809fe7b9f64eb0e4a4141d10179b282c97f330965f5a0b99019abe7326665dbfbe36de2f60a2933bf8eadaae727c01

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

1492 timeout.exe
1080 timeout.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2b42a9613d2132e3fcc1f7fbac390b24.exe

description pid process

Token: SeDebugPrivilege 952 2b42a9613d2132e3fcc1f7fbac390b24.exe

pid	process
1492	timeout.exe
1080	timeout.exe

description	pid	process
Token: SeDebugPrivilege	952	2b42a9613d2132e3fcc1f7fbac390b24.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

2b42a9613d2132e3fcc1f7fbac390b24.execmd.execmd.exe

description	pid	process	target process
PID 952 wrote to memory of 720	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 952 wrote to memory of 720	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 952 wrote to memory of 720	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 952 wrote to memory of 720	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 720 wrote to memory of 1492	720	cmd.exe	timeout.exe
PID 720 wrote to memory of 1492	720	cmd.exe	timeout.exe
PID 720 wrote to memory of 1492	720	cmd.exe	timeout.exe
PID 720 wrote to memory of 1492	720	cmd.exe	timeout.exe
PID 952 wrote to memory of 616	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 952 wrote to memory of 616	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 952 wrote to memory of 616	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 952 wrote to memory of 616	952	2b42a9613d2132e3fcc1f7fbac390b24.exe	cmd.exe
PID 616 wrote to memory of 1080	616	cmd.exe	timeout.exe
PID 616 wrote to memory of 1080	616	cmd.exe	timeout.exe
PID 616 wrote to memory of 1080	616	cmd.exe	timeout.exe
PID 616 wrote to memory of 1080	616	cmd.exe	timeout.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C timeout 10
2⤵
- Suspicious use of WriteProcessMemory
PID:720

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:1492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C timeout 10
2⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:1080

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/952-54-0x0000000000F90000-0x0000000000FD4000-memory.dmp

Filesize
272KB

Download
memory/952-55-0x00000000756C1000-0x00000000756C3000-memory.dmp

Filesize
8KB

Download
memory/952-56-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Filesize
4KB

Download