bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29

Analysis

Target

bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
Size

816KB
MD5

62fd0aecb02f01f3a59131ba5ae8d38a
SHA1

2c89f903ad958316ed22706c740cde7ee759247f
SHA256

bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29
SHA512

84ef0834069a71dc1e4b73c2a927a7357dc066ff72ef479166695d45ee631155b785c1009248b2fbb8452945f8db83f4e89e5cbbc4f974d2d7ac05f8f68e2dba

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4772	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
4772	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
4772	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4288	4772	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe	80
PID 4772 wrote to memory of 4288	4772	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe	80
PID 4772 wrote to memory of 4288	4772	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe	80

C:\Users\Admin\AppData\Local\Temp\bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
"C:\Users\Admin\AppData\Local\Temp\bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4288

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact