7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019

Analysis

Target

7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe
Size

28KB
MD5

eb8385915f68d5fbbf7c0c05e480a999
SHA1

a72734fcddbad58308d91274ad444a5b1d970c21
SHA256

7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019
SHA512

f75fbebb4583e356e5071b187fd956067f029c46ad2c2b8e300d6d5bfacdce0690abf19b29743f8c6d09dd7e389e5d11067c5292b074d5017f7a444f1770d736

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

976 powershell.exe

pid	process
976	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1184	7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe
Token: SeDebugPrivilege	976	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe

description	pid	process	target process
PID 1184 wrote to memory of 976	1184	7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe	powershell.exe
PID 1184 wrote to memory of 976	1184	7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe	powershell.exe
PID 1184 wrote to memory of 976	1184	7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe	powershell.exe
PID 1184 wrote to memory of 976	1184	7d7d9a9df8b8ffd0a0c652a3d41b9a5352efb19424e42942aaf26196c9698019.exe	powershell.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/976-61-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/976-60-0x00000000706D1000-0x00000000706D2000-memory.dmp

Filesize
4KB

Download
memory/976-62-0x00000000706D2000-0x00000000706D4000-memory.dmp

Filesize
8KB

Download
memory/976-63-0x00000000023E1000-0x00000000023E2000-memory.dmp

Filesize
4KB

Download
memory/976-64-0x00000000023E2000-0x00000000023E4000-memory.dmp

Filesize
8KB

Download
memory/1184-55-0x0000000000110000-0x0000000000118000-memory.dmp

Filesize
32KB

Download
memory/1184-56-0x000000007445E000-0x000000007445F000-memory.dmp

Filesize
4KB

Download
memory/1184-57-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1184-58-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/1184-65-0x0000000004910000-0x0000000004960000-memory.dmp

Filesize
320KB

Download