5fe0019d6f989fce985675858bc07cb618533ae9d24021f17b269a95491790e6

Resubmissions

14-07-2022 15:43

17-06-2022 01:34

Target

SecuriteInfo.com.Variant.Symmi.62789.12610.exe
Size

1.1MB
MD5

b28430a5bb7d1628b5fee2c860852861
SHA1

b2668bb306df85a1dea2cf89583ed68b25ec3048
SHA256

5fe0019d6f989fce985675858bc07cb618533ae9d24021f17b269a95491790e6
SHA512

f04ef53619efa7dd3a06ae3207e21385ab9b5703d20a9a1b080430991e0410b3c21cd0409941316b610f7021d46f6bcc2989e5f49333f18f16f01dda414fdbc5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SecuriteInfo.com.Variant.Symmi.62789.12610.exe

pid	process
3136	SecuriteInfo.com.Variant.Symmi.62789.12610.exe
3136	SecuriteInfo.com.Variant.Symmi.62789.12610.exe
3136	SecuriteInfo.com.Variant.Symmi.62789.12610.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

SecuriteInfo.com.Variant.Symmi.62789.12610.exe

description	pid	process	target process
PID 3136 wrote to memory of 4824	3136	SecuriteInfo.com.Variant.Symmi.62789.12610.exe	cmd.exe
PID 3136 wrote to memory of 4824	3136	SecuriteInfo.com.Variant.Symmi.62789.12610.exe	cmd.exe
PID 3136 wrote to memory of 4824	3136	SecuriteInfo.com.Variant.Symmi.62789.12610.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Symmi.62789.12610.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Symmi.62789.12610.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4824

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact