7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c

Analysis

max time kernel
145s
max time network
148s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
19/09/2022, 17:20

Target

7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe
Size

10KB
MD5

fac5f98558c63736c6e29e9f4d5c00bd
SHA1

a327af3bddbfd7aca749a4e32880437f3a2f46fe
SHA256

7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c
SHA512

072d70d87cdd507c800eb33b646ce645ab21a585c986b93347456761fdfb50e070215e764dfaaacf065b135b774431297c7277d0d09e2f6dc883146c8f8d31c7
SSDEEP

96:3V1GSBC0XF3eHc5nLdzWIrXCG7cgh8GqtPn9Vevb5v1P9BqKFnUC:3zxfVOWJzXyecgh8G2PnHGvvBeC

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5012 set thread context of 3416	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	68

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe
5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe
3416	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	3416	AppLaunch.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 5040	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	66
PID 5012 wrote to memory of 5040	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	66
PID 5012 wrote to memory of 3416	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	68
PID 5012 wrote to memory of 3416	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	68
PID 5012 wrote to memory of 3416	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	68
PID 5012 wrote to memory of 3416	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	68
PID 5012 wrote to memory of 3416	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	68
PID 5012 wrote to memory of 3416	5012	7ae04d8297f8f3167216ad325fc3b2841ee6d29e6ef23f7cde83159adf61c97c.exe	68

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/3416-139-0x0000000140000000-0x0000000140078000-memory.dmp

Filesize
480KB

Download
memory/3416-147-0x000002A964E80000-0x000002A964F26000-memory.dmp

Filesize
664KB

Download
memory/3416-149-0x000002A964F30000-0x000002A964F7E000-memory.dmp

Filesize
312KB

Download
memory/3416-158-0x000002A965180000-0x000002A9651CC000-memory.dmp

Filesize
304KB

Download
memory/5012-120-0x000001A36EE80000-0x000001A36EE86000-memory.dmp

Filesize
24KB

Download
memory/5012-121-0x000001A371440000-0x000001A37155C000-memory.dmp

Filesize
1.1MB

Download
memory/5012-122-0x000001A370A70000-0x000001A370B02000-memory.dmp

Filesize
584KB

Download
memory/5012-123-0x000001A370B00000-0x000001A370B22000-memory.dmp

Filesize
136KB

Download
memory/5040-131-0x000002693D8B0000-0x000002693D926000-memory.dmp

Filesize
472KB

Download