6fc5883456ca655a74a91c3127486ab5c21186308fdebfca4ec9035e09d7069a

Analysis

Target

tmp.exe
Size

73KB
MD5

e8032d887188081e383a6ebd6dbcd33a
SHA1

ccbd2b7b1dc9688098636bf4a778ae1e5e90dd17
SHA256

6fc5883456ca655a74a91c3127486ab5c21186308fdebfca4ec9035e09d7069a
SHA512

21babd4ff02d906274256c9a6defd85843f08d56a863c4f127f873652cb9b6205e13c581e6eed4ef51f617b4b85efcd87c7473398712131e21ace792fb235060

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1300 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exetmp.exe

description pid process

Token: SeDebugPrivilege 1300 powershell.exe
Token: SeDebugPrivilege 872 tmp.exe

pid	process
1300	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	872	tmp.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 872 wrote to memory of 1300	872	tmp.exe	powershell.exe
PID 872 wrote to memory of 1300	872	tmp.exe	powershell.exe
PID 872 wrote to memory of 1300	872	tmp.exe	powershell.exe
PID 872 wrote to memory of 1300	872	tmp.exe	powershell.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/872-54-0x0000000000230000-0x0000000000248000-memory.dmp

Filesize
96KB

Download
memory/872-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/1300-56-0x0000000000000000-mapping.dmp

Download
memory/1300-58-0x000000006F910000-0x000000006FEBB000-memory.dmp

Filesize
5.7MB

Download
memory/1300-59-0x000000006F910000-0x000000006FEBB000-memory.dmp

Filesize
5.7MB

Download