f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4

Analysis

max time kernel
134s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:06

Target

f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
Size

89KB
MD5

341b70cee32d77dbfea0fd2a8e478fe7
SHA1

164da9599a28d1d71a4b7a5e282b9f954f36370d
SHA256

f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4
SHA512

8aaaed938093efd968809f32244369e513b7b86a0aa0f3e584e73f2b1db041022ee701ea26392f6ceeff422c4c4dba48953aed87a9fbcbeabc0af0dede269d1b
SSDEEP

1536:qAvOyB7efrmahettXJrq+eukSZWEStO4YdD2Ml8KYLBmgULh9WAoGvboEa:qAvD7ejJgttXJ4ukSZWvOR2GYLrUiabG

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe

pid process

1048 f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe

pid	process
1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe

description	pid	process	target process
PID 1048 set thread context of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe

description	pid	process	target process
PID 1048 wrote to memory of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
PID 1048 wrote to memory of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
PID 1048 wrote to memory of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
PID 1048 wrote to memory of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
PID 1048 wrote to memory of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
PID 1048 wrote to memory of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
PID 1048 wrote to memory of 4900	1048	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe	f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe

C:\Users\Admin\AppData\Local\Temp\f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe
"C:\Users\Admin\AppData\Local\Temp\f9690290adbb729d6c9602d708cd3176c6faa84df9eeb09d6275f7ec31e729c4.exe"
2⤵
PID:4900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsr9997.tmp\FSeYEPyGSWDFKvf.dll

Filesize
73KB

MD5
4012fe0f10091f4f8b7d922fcdde6ca3

SHA1
4e5cf031b0ed1001aa4dbca89ab933ba1ffb3916

SHA256
bebf3b6c754d7c5d6ab309b9433b8cd9000947ccbafb97c6cfd9578c24ce3d06

SHA512
a9c26a968e4cf17db3f35d7c1bf89966d3eea07c0710ce6e1cb1567390483127aa77fc5228ded93c87f3ad1c32518610f3170119cb9bfef130daa3d5cb6fc79b

Download Submit
memory/4900-133-0x0000000000000000-mapping.dmp

Download
memory/4900-134-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download