a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425

Analysis

max time kernel
153s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 20:58

Target

a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425.exe
Size

1.0MB
MD5

906c9882d3fd2791d344b00e183e4ee3
SHA1

9fdb27970eb0444de8c587c6cb49a416319684b1
SHA256

a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425
SHA512

51f430628283ba9f0818160d8e87a2bfbc7b8521ab7b088d86ad1ac91015b716264d176add354e8f59f24373f2d9f1b8c58ef64573cc14caeec85b7fdf0f07e4
SSDEEP

12288:D6SKqT31T6WpJY6V765jKqostkm3ObEkizMWCfA1LV:2xqT31T6WE6I5jKqosOm+bEyWqA1LV

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 5072	4648	a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425.exe	80
PID 4648 wrote to memory of 5072	4648	a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425.exe	80
PID 4648 wrote to memory of 5072	4648	a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425.exe	80

C:\Users\Admin\AppData\Local\Temp\a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425.exe
"C:\Users\Admin\AppData\Local\Temp\a8ece6db229b1c6661b0d358e21a8a8c379a76008d4dffd8a9dce63a7bfa0425.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\s.cmd
  2⤵
  PID:5072

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\s.cmd

Filesize
285B

MD5
8b6c27fcbccd8db5dda09e0be8fcaab5

SHA1
638985d8f32b263133be545462f62bcc688cd427

SHA256
b9187e22fa97886b25b1f5b2163b34885426fb650f6495fac1f318e97a57ace0

SHA512
e564c80aeb2bd5239fb3ae70d866136dc029c93335829a54022a194840b1a07d2b37efdb48fce5fd5a9801a2218aa6efcba3ed68fe9d1120a6de47eb5f8d2eee

Download Submit