925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c

Analysis

Target

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe
Size

9.3MB
MD5

a10948c81c94dfaa2176c58e40ad8c39
SHA1

11a2eb8172e39871e5afac4e7d048667371f1aea
SHA256

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c
SHA512

bcbddde3d450856cb4324e1015f07e3c2c53dc50ee214b19911b64d5a5922a55687531bfcd93d6f7516874f6fc9fe7493dddbbc231ab55b26ea60d9b384e00cf

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe

description	pid	process	target process
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe
"C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AAEF.tmp\AB5D.bat C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe"
  2⤵
  PID:1344

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\AAEF.tmp\AB5D.bat

MD5
221a5b78e84926beac2c4bbae465eab1

SHA1
dd577cae4cced36a8a827c4f4ffeafb0a7676861

SHA256
fe783973ea583f903ff36bf9af41464356b09e40daa55e129e4fd92a89b4c50a

SHA512
1cc0e1da5b6a1c7a3d37c4361d57440fc7bcbdae416e78ffd9e51076bf13c842b90344beef6b319fc46f8eb0ccc5b05d612d3db088ba7575724ce92614975647

Download Submit
memory/1368-54-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download