736e922d451686797ec76431a5c40aab65da4cc9de49fc8a898c013f44caf2ce

Analysis

Target
21673a4749aeeabb4fa393b40b31f5c7.exe
Size 308KB
Sample220302-x9h3sshfgk
SHA256 736e922d451686797ec76431a5c40aab65da4cc9de49fc8a898c013f44caf2ce
MD5 21673a4749aeeabb4fa393b40b31f5c7
SHA1 f146444b7ca15ad4c3efc01eca7503db4eb72519
SHA512 90317bb9d59d9362691db04b42480421b42dac9ca855fd0bf1d98f690a7e99e96f0ff8a9ede0fadcb9ee498c9a41bd7ff340af85c52afe7458c4b1b87f2f12f3
MD5 SHA1 SHA512

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
368	usfcovems.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 368	608	21673a4749aeeabb4fa393b40b31f5c7.exe	79
PID 608 wrote to memory of 368	608	21673a4749aeeabb4fa393b40b31f5c7.exe	79
PID 608 wrote to memory of 368	608	21673a4749aeeabb4fa393b40b31f5c7.exe	79
PID 368 wrote to memory of 1172	368	usfcovems.exe	80
PID 368 wrote to memory of 1172	368	usfcovems.exe	80
PID 368 wrote to memory of 1172	368	usfcovems.exe	80

C:\Users\Admin\AppData\Local\Temp\21673a4749aeeabb4fa393b40b31f5c7.exe
"C:\Users\Admin\AppData\Local\Temp\21673a4749aeeabb4fa393b40b31f5c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Users\Admin\AppData\Local\Temp\usfcovems.exe
  C:\Users\Admin\AppData\Local\Temp\usfcovems.exe C:\Users\Admin\AppData\Local\Temp\rekdj
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:368
- - C:\Users\Admin\AppData\Local\Temp\usfcovems.exe
    C:\Users\Admin\AppData\Local\Temp\usfcovems.exe C:\Users\Admin\AppData\Local\Temp\rekdj
    3⤵
    PID:1172

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact