ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9

Analysis

max time kernel
127s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 01:12

Target

ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9.exe
Size

895KB
MD5

70444d7fbd8abd36d455e0eda0abf711
SHA1

b57cfab674e3d7cfa6155763fbd1fa2561921db5
SHA256

ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9
SHA512

a81c2c24b6284557630885c7f8914423ecee61de97f7fe5fd765551131f890a283bd9acd8d257d3aa9c1718d1830ad0e2f866f01020402651c89446f6dcc97fc
SSDEEP

24576:AxqT31T6WE6I5jKqosOm+b5Ak+/cTI3sh3+:P6WE6IN95+b5Al/cTI3sh3+

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 4900	2264	ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9.exe	82
PID 2264 wrote to memory of 4900	2264	ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9.exe	82
PID 2264 wrote to memory of 4900	2264	ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9.exe	82

C:\Users\Admin\AppData\Local\Temp\ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9.exe
"C:\Users\Admin\AppData\Local\Temp\ba966e0c226f46ceaecfe20d1ac32aaeec2b4b81f09885e167c02e3f769be4c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\s.cmd
  2⤵
  PID:4900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\s.cmd

Filesize
285B

MD5
4f42ddacf87dec2796e1f9cd34c52685

SHA1
647950033a85159e033f798099979f1e7ee023fb

SHA256
1ee7db473d6954af3fe61e35d5057fe413d8149a55c4794cd626a18538f9cf67

SHA512
9bef17c292f943c182f7f335b70075c63d9ba8c66762b276af3079af533de78fb14c285174d5b3b767deaa09a524e3e100a64e54958d8739a27c82d66f3dfe86

Download Submit