601eabe782aff7a264fb37953d0ff488118936bb1a3e2a23e822d4919783c86c

Analysis

max time kernel
41s
max time network
107s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 00:38

Target

a/J.class
Size

358B
MD5

fcb3ee8a38a5c46d50c0e93c66a2be33
SHA1

d2cfbc0682adb7459508c2002882b1e90e2316f8
SHA256

3d0850ca70e2b232793106f986d3c2c2fe09fb858eaccebdc18d35c4ce039da6
SHA512

76e34184aceb9a920aacc389fe444192dac12956efd1ebbcfbc7a785f2cd0fc61022a339281058ecf508308188bf65fa99731a5a6ad56a11b710bd6946f73d12

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 800	1436	cmd.exe	29
PID 1436 wrote to memory of 800	1436	cmd.exe	29
PID 1436 wrote to memory of 800	1436	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a\J.class
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a\J.class
  2⤵
  PID:800
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a\J.class"
    3⤵
    PID:1360

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1360-82-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1436-54-0x000007FEFC481000-0x000007FEFC483000-memory.dmp

Filesize
8KB

Download