f0f262dfeee40f1a3a03cbb571cd4cc9bd526420b81bff511f44dec6c5f197fb

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2022, 03:34

Target
SecuriteInfo.com.Variant.Ursu.936368.29716.exe
Size 3.8MB
Sample220822-d4ryzadba7
SHA256 f0f262dfeee40f1a3a03cbb571cd4cc9bd526420b81bff511f44dec6c5f197fb
MD5 8ab6693f33e00239c878ff850124c00f
SHA1 04401b374b72bc18956efc93bccbc37f80970d0f
SHA512 ed1adcdc71695c474c09d5f5e440d0c856b5b67db88943b29c4a8254dd4d815437ad0490209be6ea048e2b90292909c032753b6b03a536a21037f619251faab2
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3552	SecuriteInfo.com.Variant.Ursu.936368.29716.exe
3552	SecuriteInfo.com.Variant.Ursu.936368.29716.exe
3552	SecuriteInfo.com.Variant.Ursu.936368.29716.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4676	3552	SecuriteInfo.com.Variant.Ursu.936368.29716.exe	86
PID 3552 wrote to memory of 4676	3552	SecuriteInfo.com.Variant.Ursu.936368.29716.exe	86
PID 3552 wrote to memory of 4676	3552	SecuriteInfo.com.Variant.Ursu.936368.29716.exe	86

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.936368.29716.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.936368.29716.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:4676

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact