507a850616e8fec0600a8973ae9dc6bde0a07b8e68953fa74a760ccebef77f4e

Analysis

max time kernel
75s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2022, 14:40

Target
df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe
Size 4.3MB
Sample220818-r2ccdsaha2
SHA256 df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3
MD5 d34766180061c5b0e65b4d37274be18a
SHA1 7bfceba0bd7de874ea91543bcd4da45d1f01bba1
SHA512 ef0f19dda7bb1f74d35261de05d8744233fff365a82ee11e4a0d0e3037c9f57c0fa23b82b01923487bf8551fd99bc83499edac03c1c0b009f7525f20101107b9
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2692	df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe
2692	df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe
2692	df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 4860	2692	df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe	83
PID 2692 wrote to memory of 4860	2692	df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe	83
PID 2692 wrote to memory of 4860	2692	df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe	83

C:\Users\Admin\AppData\Local\Temp\df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe
"C:\Users\Admin\AppData\Local\Temp\df8c4a61667091f9101ad764708b7d70398842bceef21b13729c32f8db48dcd3.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4860

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact