67bca7693dc85446a8a88d8f88d502c99f6d150dbb8aad95f6a72c58eb20e27e

Analysis

Target

SecuriteInfo.com.Variant.Tedy.136216.9869.exe
Size

1.4MB
MD5

aed638ecf5b9b00c1d311650fbf3c04a
SHA1

272f96885e4308dc24c2a6cf62a0616711cbb373
SHA256

67bca7693dc85446a8a88d8f88d502c99f6d150dbb8aad95f6a72c58eb20e27e
SHA512

c940427c2a15585aa83156abab9e65c82d3a82ea8a5547424c476a77aa004c31a8644932a06205cdcad079b302303dd62b4624ecb67f0a0462e31a73873521d0

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1736	SecuriteInfo.com.Variant.Tedy.136216.9869.exe
1736	SecuriteInfo.com.Variant.Tedy.136216.9869.exe
1736	SecuriteInfo.com.Variant.Tedy.136216.9869.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2968	1736	SecuriteInfo.com.Variant.Tedy.136216.9869.exe	80
PID 1736 wrote to memory of 2968	1736	SecuriteInfo.com.Variant.Tedy.136216.9869.exe	80
PID 1736 wrote to memory of 2968	1736	SecuriteInfo.com.Variant.Tedy.136216.9869.exe	80

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.136216.9869.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Tedy.136216.9869.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2968

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact