5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b

Analysis

max time kernel
149s
max time network
42s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
02-08-2022 02:44

Target

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe
Size

281KB
MD5

a0ad66bbe2af5c64af859ed1b250e145
SHA1

5a85f7fa7ed7b2c706b3bbfb8f42fba757420c0f
SHA256

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b
SHA512

ab20e4f71c17dfea5b5ceb891add576d4de86da2c452ab2e754605c3ee47978a2d37b1780d2fabed44ddd8648b8b558f4273ae6eede316cddeabb668d01a8963

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 2 IoCs

Processes:

cmd.execmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description pid process

Token: SeDebugPrivilege 2036 5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	pid	process
Token: SeDebugPrivilege	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe

description	pid	process	target process
PID 2036 wrote to memory of 1340	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 2036 wrote to memory of 1340	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 2036 wrote to memory of 1340	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 2036 wrote to memory of 1340	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 2036 wrote to memory of 892	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 2036 wrote to memory of 892	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 2036 wrote to memory of 892	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe
PID 2036 wrote to memory of 892	2036	5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier"
2⤵
- NTFS ADS
PID:1340

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C type nul > "C:\Users\Admin\AppData\Local\Temp\5aab5e4728c5990e3271df6d9aaef86563e6f540203eed3dc7f1e7ce7e36771b.exe:Zone.Identifier"
2⤵
- NTFS ADS
PID:892

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/892-59-0x0000000000000000-mapping.dmp

Download
memory/1340-57-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000000220000-0x000000000026C000-memory.dmp

Filesize
304KB

Download
memory/2036-55-0x00000000005E0000-0x000000000060A000-memory.dmp

Filesize
168KB

Download
memory/2036-56-0x00000000754D1000-0x00000000754D3000-memory.dmp

Filesize
8KB

Download
memory/2036-58-0x0000000004220000-0x0000000004228000-memory.dmp

Filesize
32KB

Download
memory/2036-60-0x0000000004620000-0x000000000462C000-memory.dmp

Filesize
48KB

Download
memory/2036-61-0x0000000002060000-0x000000000206C000-memory.dmp

Filesize
48KB

Download