54997b3a185bb73053e5dde15e7bd265463d9a3cd8bedc93290329de84dd5422

Analysis

max time kernel
150s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07-09-2022 06:53

Target

Company Profile.exe
Size

138KB
MD5

5ef9770e747140ed283a43f0c2404174
SHA1

3bdecc8b3a2df4919e5a0c0517558c083a06e23d
SHA256

54997b3a185bb73053e5dde15e7bd265463d9a3cd8bedc93290329de84dd5422
SHA512

2e57288641a1d22f5a88170c2236a5390a9a65154e14ffb9ee9f6feebe7a89227178abfccc8782cbe7ce903137ad32c536a1e31bdd84de393e724845554c2c99
SSDEEP

3072:SBkfJpRXATwMdFCcAiiPiaakFrgXWy8+sOBmxw9yPI7sR0bUg7TEnI2def8AoVGv:SqjIOiiPiaIjtx7OI2efkVGxwIQL+

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Goddamn\Afskedsbreve\Ischuretic.Wav	Company Profile.exe
File opened for modification	C:\Windows\resources\0409\Vernacularizing183.ini	Company Profile.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Company Profile.exe
"C:\Users\Admin\AppData\Local\Temp\Company Profile.exe"
1⤵
- Drops file in Windows directory
PID:1380

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1380-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download