b626826522cb18cec741b324a13d2b59c590b482efa73ecca4e93ec4ebd02405

Analysis

Target

Invoice_47399.exe
Size

1.1MB
MD5

3d1ab8ea27ac65a81e0f4cf09e5c3dcc
SHA1

6fb0d330cd8198b24a7aa241c2937c2798f42f00
SHA256

b626826522cb18cec741b324a13d2b59c590b482efa73ecca4e93ec4ebd02405
SHA512

894d420cbfcb5c1c9af745409ca36bb4dbb1e9bf4d8a9e344cccaf4d996775607dfb398ba8c846764e274c78cc9ebd2f7c2ca6e4fe7bedcd9f345a2a9bec4453

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 4632	4840	Invoice_47399.exe	83
PID 4840 wrote to memory of 4632	4840	Invoice_47399.exe	83
PID 4840 wrote to memory of 4632	4840	Invoice_47399.exe	83

C:\Users\Admin\AppData\Local\Temp\Invoice_47399.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice_47399.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4632

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact