601eabe782aff7a264fb37953d0ff488118936bb1a3e2a23e822d4919783c86c

Analysis

max time kernel
42s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 00:38

Target

a/H.class
Size

401B
MD5

8b32607921d33725facfb12c68aa7691
SHA1

05527d92fd44ae4b4ec683a416560cb8bf959593
SHA256

a686598429c3a28f8dd028fc17bc4be3d5834ba5125694957e24855ae46a8f5f
SHA512

c9e2ff4e4654b04f063543f06def1ad43cdd10f741c5a4e43e3ee391a92fe5e6d7e49d507ea2db8ed2a57d83015d92b78c607c6ed4075906c1d8e866af2577ce

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 612	1708	cmd.exe	29
PID 1708 wrote to memory of 612	1708	cmd.exe	29
PID 1708 wrote to memory of 612	1708	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a\H.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a\H.class
  2⤵
  PID:612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a\H.class"
    3⤵
    PID:432

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/432-82-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download
memory/1708-54-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download