93fb364764d838a7f022d9bf368ea9663ebe686e4b7a1647a57d464ba2f7dbc6

Analysis

Target
Debit_Invoice.exe
Size 1.5MB
Sample220614-hw4d9agfa8
SHA256 0d3bfc388f1c5a6e131c708b80ad8cd43ed45c96bb0893f95f986ad4f7a29bb7
MD5 8a045b880ead4d0ac9b9709fad3547b6
SHA1 2a1fd9cdf9c35a40aa73af46b6dd345a2903dfac
SHA512 78593283f031102b59160170c0ae2500e3201824e3731b977e8400e1c4d1ddfa771b8bc64dc8a37fd5c3225132091de6a87d30d217428244944520d3f10d9082
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1456	3076	Debit_Invoice.exe	78
PID 3076 wrote to memory of 1456	3076	Debit_Invoice.exe	78
PID 3076 wrote to memory of 1456	3076	Debit_Invoice.exe	78

C:\Users\Admin\AppData\Local\Temp\Debit_Invoice.exe
"C:\Users\Admin\AppData\Local\Temp\Debit_Invoice.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1456

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact