e3818c229b45e08ca6423d9942f7a1135270fe28eedb5adeb419e7473f288001

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
resource tags

arch:x64arch:x86image:win10v2004-20220414-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2022, 14:36

Target
SecuriteInfo.com.W32.AIDetect.malware2.27510.exe
Size 1.4MB
Sample220718-rykjlafgap
SHA256 e3818c229b45e08ca6423d9942f7a1135270fe28eedb5adeb419e7473f288001
MD5 25345e3d806b7f3f0c96344ee09930c4
SHA1 afd9f60c2542f16a5d03a068e80fbbdefd519fca
SHA512 a54b1fcadd5c50b9c37482b8e82e3a6cc31cc04d8cf7a0436aa749c1db1837361e914a587bc45c313498d34461c3b5466ba73313d4951a5c3da208c90e1b7a5d
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3492	SecuriteInfo.com.W32.AIDetect.malware2.27510.exe
3492	SecuriteInfo.com.W32.AIDetect.malware2.27510.exe
3492	SecuriteInfo.com.W32.AIDetect.malware2.27510.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 832	3492	SecuriteInfo.com.W32.AIDetect.malware2.27510.exe	78
PID 3492 wrote to memory of 832	3492	SecuriteInfo.com.W32.AIDetect.malware2.27510.exe	78
PID 3492 wrote to memory of 832	3492	SecuriteInfo.com.W32.AIDetect.malware2.27510.exe	78

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.27510.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.27510.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:832

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact