17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709

Analysis

max time kernel
93s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 20:58

Target

17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709.exe
Size

660KB
MD5

a0a6918cd4e20d20935bca4f579d2d20
SHA1

2301f239242d2681aedc6554cf62e62dd28499b4
SHA256

17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709
SHA512

b61b683248d0385956a49f0fb2318e2d93f91015dca832cede0b6e223a5cbab13ea28d9ec962f096ec1bdf4a5e3fb04c4085fef2ae7046d28f9fc5f04b08ea84
SSDEEP

12288:T6SKqT31T6WpJY6V765jKqostkm3ObCTx7hrI7E:mxqT31T6WE6I5jKqosOm+bCvrI7E

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 1944	4264	17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709.exe	80
PID 4264 wrote to memory of 1944	4264	17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709.exe	80
PID 4264 wrote to memory of 1944	4264	17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709.exe	80

C:\Users\Admin\AppData\Local\Temp\17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709.exe
"C:\Users\Admin\AppData\Local\Temp\17dd4d184014a52e749253ad478aed93f02ee4bf9e61060c4a0b1ef8cda12709.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\s.cmd
  2⤵
  PID:1944

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\s.cmd

Filesize
285B

MD5
85ba0d94ac943f05713867a3ca3c29ed

SHA1
092f7d1db4a76b38486ba1d404da918817af496f

SHA256
c144c70d88963a86e7d39fef43edf03b69355d473a05409723e841d86421aed7

SHA512
072befcdc6315fd4a0c77c6dc10074f8f50ab9f6d8e1aeee79bcb0fecf73b51bcd325a1e675a020442f6448ffb1842e168c09ac9751e69b0d25420ec0e5b79f6

Download Submit