b12fa782c5a1e950d3a2a2ae57bb843c56efe1994f25a02fd088f312ea8523bc

Resubmissions

14-07-2022 15:42

20-06-2022 03:33

Target

SecuriteInfo.com.Variant.Symmi.62789.8540.exe
Size

1.0MB
MD5

4c5fcb8c248337612968ed1ea3715516
SHA1

472373a2d24b5bc9eacaf9f094e8ff995aef4028
SHA256

b12fa782c5a1e950d3a2a2ae57bb843c56efe1994f25a02fd088f312ea8523bc
SHA512

4a3af215cefa05fb9e7f8d2ff1f11eb9466221ec63915234ffc068970eaec2d88a1915be5c209631ab45ac298fe6515b809a6403d5be5f22f3001f4a0a8ab6dd

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SecuriteInfo.com.Variant.Symmi.62789.8540.exe

pid	process
3076	SecuriteInfo.com.Variant.Symmi.62789.8540.exe
3076	SecuriteInfo.com.Variant.Symmi.62789.8540.exe
3076	SecuriteInfo.com.Variant.Symmi.62789.8540.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.Variant.Symmi.62789.8540.exe

description	pid	process	target process
PID 3076 wrote to memory of 3368	3076	SecuriteInfo.com.Variant.Symmi.62789.8540.exe	cmd.exe
PID 3076 wrote to memory of 3368	3076	SecuriteInfo.com.Variant.Symmi.62789.8540.exe	cmd.exe
PID 3076 wrote to memory of 3368	3076	SecuriteInfo.com.Variant.Symmi.62789.8540.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Symmi.62789.8540.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Symmi.62789.8540.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:3368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact