412bc5d35a364efe1b6bf256937961482f6202dde2f1581563ce738537f990c4

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 08:34

Target

SecuriteInfo.com.Variant.Bulz.342535.32662.exe
Size

4.3MB
MD5

d81e2a99d627cd3111580cb9bc051e08
SHA1

6f620d09c49c0caeb74597a8f84a56d7614ce2e1
SHA256

412bc5d35a364efe1b6bf256937961482f6202dde2f1581563ce738537f990c4
SHA512

70e15b0b1c702fc2a4bf8526b80f1df4eb9c1e9285791bee2afad4801e0179e283d27d0327ee7ca66ccb71f8aaf7fc399b34d8328f651fbdf143113c208e3a14

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3256	SecuriteInfo.com.Variant.Bulz.342535.32662.exe
3256	SecuriteInfo.com.Variant.Bulz.342535.32662.exe
3256	SecuriteInfo.com.Variant.Bulz.342535.32662.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 1400	3256	SecuriteInfo.com.Variant.Bulz.342535.32662.exe	81
PID 3256 wrote to memory of 1400	3256	SecuriteInfo.com.Variant.Bulz.342535.32662.exe	81
PID 3256 wrote to memory of 1400	3256	SecuriteInfo.com.Variant.Bulz.342535.32662.exe	81

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.342535.32662.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Bulz.342535.32662.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1400

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact