ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2

Analysis

max time kernel
2s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 05:22

Target

ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe
Size

53KB
MD5

4628e159d6fad9e79ea2c2d3ed6d9f3d
SHA1

340c0853056a6049de4cd8c2c0890573d6984333
SHA256

ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2
SHA512

ebbedd8203e79109e43ec7b55fad2d87afe474dfc9e501e35a1d00a6b53f5e012ccd600a0495f648cad1e3dbd599d8a9c8f75e5c478bac9299a962b89effbe64
SSDEEP

768:uJChTypVTFylNCQKowZS4E6SynTruH712N3b4wFBOV1mJt6oRZPJW2q5Q/2wRC:uAhTyTTFQNC13U4rtnDb4tmJ8AJq4c

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1700	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	28
PID 996 wrote to memory of 1700	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	28
PID 996 wrote to memory of 1700	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	28
PID 996 wrote to memory of 1700	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	28
PID 996 wrote to memory of 1700	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	28
PID 996 wrote to memory of 1700	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	28
PID 996 wrote to memory of 1700	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	28
PID 996 wrote to memory of 1936	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	29
PID 996 wrote to memory of 1936	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	29
PID 996 wrote to memory of 1936	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	29
PID 996 wrote to memory of 1936	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	29
PID 996 wrote to memory of 1936	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	29
PID 996 wrote to memory of 1936	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	29
PID 996 wrote to memory of 1936	996	ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe	29

C:\Users\Admin\AppData\Local\Temp\ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe
"C:\Users\Admin\AppData\Local\Temp\ee8a5d96f52f848ac762475bdee43618d1d88d8ecf87c20c5527c0e877ee6fe2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"
  2⤵
  PID:1700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\1.vbs"
  2⤵
  PID:1936

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\newsetup.vbs

Filesize
651B

MD5
4736e7158c27f244482f5a614b9dbdae

SHA1
d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9

SHA256
b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc

SHA512
cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824

Download Submit
memory/996-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download