84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a

Analysis

max time kernel
67s
max time network
71s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 15:57

Target

84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe
Size

596KB
MD5

060e1b6f31b6cdec27a6781f74afd817
SHA1

6b81a1ebc95d7bacd316583412fd01c15a52dc4b
SHA256

84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a
SHA512

761fcc303ff3386447cf32e58afba432959e5228e6722fb5ea7a6e42cb55d79f2ac1554f66cd5cb2ff61c41986e032995d463e2142d933af3932ea93496ff63b
SSDEEP

12288:7DYzYK7Q21AmY/AE+zUalJJF8HIQjqyPOIQriA4:/ZSz1AmsA/UHHI+cIQmt

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1728	svchst.exe

Deletes itself 1 IoCs

pid	Process
976	WScript.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchst.exe	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe
File opened for modification	C:\Windows\svchst.exe	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1264	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 976	1264	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe	29
PID 1264 wrote to memory of 976	1264	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe	29
PID 1264 wrote to memory of 976	1264	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe	29
PID 1264 wrote to memory of 976	1264	84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe	29

C:\Users\Admin\AppData\Local\Temp\84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe
"C:\Users\Admin\AppData\Local\Temp\84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\3328.vbs"
  2⤵
  - Deletes itself
  PID:976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\3328.vbs

Filesize
500B

MD5
1f6f7204fb8f69c25f0a8af19c1c50f0

SHA1
958e3713ee2c6d1fcf90b8f3f01a83ffddd36c6c

SHA256
4804d615d0252a09b32c59e89ab7298af4a0d84d6bc970239a0f4dc1871e2f3d

SHA512
99d80c204a45454c843e5235a9cbdaf3ace69a0aaa884b858facd828c64a7bd22c5901ad337f9de8a492c88500e573d979f9680b84841baab7c5da861ef8b57e

Download Submit
C:\Windows\svchst.exe

Filesize
596KB

MD5
060e1b6f31b6cdec27a6781f74afd817

SHA1
6b81a1ebc95d7bacd316583412fd01c15a52dc4b

SHA256
84684fb4af3a5d0d2b545a349ca1e0d2e6d98c3d1101f00c583caa1c6743ef0a

SHA512
761fcc303ff3386447cf32e58afba432959e5228e6722fb5ea7a6e42cb55d79f2ac1554f66cd5cb2ff61c41986e032995d463e2142d933af3932ea93496ff63b

Download Submit
memory/1264-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download