57d62bbe11fe0a8c9ad261ebb382c6fd0c47d81d02dbe39c189f6a5a01f93335

Analysis

Target
SecuriteInfo.com.Variant.Symmi.62789.6258.exe
Size 1.1MB
Sample220617-by4dpshhgn
SHA256 57d62bbe11fe0a8c9ad261ebb382c6fd0c47d81d02dbe39c189f6a5a01f93335
MD5 223c639574c27f0b060c5eb051b733ae
SHA1 ae3755a1d599328cadcd521ed4c2707179fdaffc
SHA512 d78987668854d9ef9971d8062e04b6bf153418ea7f6b8749e9f032c9a54dc7cd6eeb11271d675354a112e886dc9225a6eaa732560aed776626e0714e15da8288
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3424	SecuriteInfo.com.Variant.Symmi.62789.6258.exe
3424	SecuriteInfo.com.Variant.Symmi.62789.6258.exe
3424	SecuriteInfo.com.Variant.Symmi.62789.6258.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4116	3424	SecuriteInfo.com.Variant.Symmi.62789.6258.exe	81
PID 3424 wrote to memory of 4116	3424	SecuriteInfo.com.Variant.Symmi.62789.6258.exe	81
PID 3424 wrote to memory of 4116	3424	SecuriteInfo.com.Variant.Symmi.62789.6258.exe	81

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Symmi.62789.6258.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Symmi.62789.6258.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4116

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact