df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3

Analysis

max time kernel
64s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 08:33

Target
SecuriteInfo.com.Variant.Bulz.342535.21005.exe
Size 4.3MB
Sample220818-kfvtaafaa5
SHA256 df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3
MD5 d34766180061c5b0e65b4d37274be18a
SHA1 7bfceba0bd7de874ea91543bcd4da45d1f01bba1
SHA512 ef0f19dda7bb1f74d35261de05d8744233fff365a82ee11e4a0d0e3037c9f57c0fa23b82b01923487bf8551fd99bc83499edac03c1c0b009f7525f20101107b9
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
568	SecuriteInfo.com.Variant.Bulz.342535.21005.exe
568	SecuriteInfo.com.Variant.Bulz.342535.21005.exe
568	SecuriteInfo.com.Variant.Bulz.342535.21005.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 2256	568	SecuriteInfo.com.Variant.Bulz.342535.21005.exe	82
PID 568 wrote to memory of 2256	568	SecuriteInfo.com.Variant.Bulz.342535.21005.exe	82
PID 568 wrote to memory of 2256	568	SecuriteInfo.com.Variant.Bulz.342535.21005.exe	82

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.342535.21005.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.342535.21005.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:2256

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact