0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b

General

Target

0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
Size

1022KB
MD5

1580c3b5db72184e363d5e8521462109
SHA1

c877974a5a9b2e16aa5741b037bce28e798f5d97
SHA256

0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b
SHA512

65f2ce88166edd7c4dc4a049135d9ffb7133b069847c1a730fc4eead2e14f368adbed22c4369e070c5fb932269d0ceb2daecdc0fc62b4bd06b67a89016643dd8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 1924	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	28
PID 1660 wrote to memory of 1924	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	28
PID 1660 wrote to memory of 1924	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	28
PID 1660 wrote to memory of 1924	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	28
PID 1660 wrote to memory of 1944	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	29
PID 1660 wrote to memory of 1944	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	29
PID 1660 wrote to memory of 1944	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	29
PID 1660 wrote to memory of 1944	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	29
PID 1660 wrote to memory of 1724	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	30
PID 1660 wrote to memory of 1724	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	30
PID 1660 wrote to memory of 1724	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	30
PID 1660 wrote to memory of 1724	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	30
PID 1660 wrote to memory of 996	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	31
PID 1660 wrote to memory of 996	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	31
PID 1660 wrote to memory of 996	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	31
PID 1660 wrote to memory of 996	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	31
PID 1660 wrote to memory of 956	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	32
PID 1660 wrote to memory of 956	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	32
PID 1660 wrote to memory of 956	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	32
PID 1660 wrote to memory of 956	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	32
PID 1660 wrote to memory of 2004	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	33
PID 1660 wrote to memory of 2004	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	33
PID 1660 wrote to memory of 2004	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	33
PID 1660 wrote to memory of 2004	1660	0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe	33

C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
"C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"
  2⤵
  PID:1924
- C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"
  2⤵
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"
  2⤵
  PID:1724
- C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"
  2⤵
  PID:996
- C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"
  2⤵
  PID:956
- C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe
  "C:\Users\Admin\AppData\Local\Temp\0f4d88a4d77359be69d6a628aa348c27c5af993683d1824d9a11ead9149eaf2b.exe"
  2⤵
  PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1660-54-0x0000000076421000-0x0000000076423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing