4bb31847846180bf78033b5eb7761b874b114f6dd086862472915be761fc042a

Analysis

Target

7zS8A52FD1B/62a1ea3215fd5_67a668.exe
Size

78KB
MD5

923ba5913c151121517c52f609242616
SHA1

7976305e7afb69e70cca1b29b3e9436b2cd08e25
SHA256

5d4b830ec56d8bbfdb305e904e6c0f00fc1744a1c7c15e8c71265d08c3aa35e0
SHA512

7e03947d789f40aacd131287d445d0e3dbe95e9ff1e6ceea211009c3424ae55884365119aa46e1bef4cc0adba108a036d9c3330ef6f3acf2f97e0f83f7a0a202

Score

10^/10

suricata

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1104 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1540 PING.EXE

pid	process
1104	cmd.exe

pid	process
1540	PING.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

62a1ea3215fd5_67a668.execmd.exe

description	pid	process	target process
PID 1056 wrote to memory of 1104	1056	62a1ea3215fd5_67a668.exe	cmd.exe
PID 1056 wrote to memory of 1104	1056	62a1ea3215fd5_67a668.exe	cmd.exe
PID 1056 wrote to memory of 1104	1056	62a1ea3215fd5_67a668.exe	cmd.exe
PID 1056 wrote to memory of 1104	1056	62a1ea3215fd5_67a668.exe	cmd.exe
PID 1104 wrote to memory of 1540	1104	cmd.exe	PING.EXE
PID 1104 wrote to memory of 1540	1104	cmd.exe	PING.EXE
PID 1104 wrote to memory of 1540	1104	cmd.exe	PING.EXE
PID 1104 wrote to memory of 1540	1104	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea3215fd5_67a668.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea3215fd5_67a668.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1056

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1056-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1104-55-0x0000000000000000-mapping.dmp

Download
memory/1540-56-0x0000000000000000-mapping.dmp

Download