66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:08

Target

66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.exe
Size

84KB
MD5

346a077761ca60cfc77e3b81fbb67a2b
SHA1

97fcfa9357918a3bcf47a0048d54869fd299b84d
SHA256

66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5
SHA512

ab006e92a5657e2483bf622e35b37b6d91cf58d4c6f4e5d41430f71e9c94f1d658d18fb98787b085a1a12955cfc46ec60b62d61b7f754b0b9547566fcb23af2e
SSDEEP

1536:/QmrZccISnemPY4aM2g1iOIr4ECpiN4Ix9z7f+DQWk4Ru:drZccISnvPY4aM/1i90EoiKIx9zils

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

comhost.exe

pid process

3312 comhost.exe
Drops startup file 1 IoCs

Processes:

comhost.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\comhost.lnk comhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.execomhost.exe

pid process

4244 66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.exe
3312 comhost.exe

pid	process
3312	comhost.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\comhost.lnk	comhost.exe

pid	process
4244	66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.exe
3312	comhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.exe

description	pid	process	target process
PID 4244 wrote to memory of 3312	4244	66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.exe	comhost.exe
PID 4244 wrote to memory of 3312	4244	66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.exe	comhost.exe
PID 4244 wrote to memory of 3312	4244	66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5.exe	comhost.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\comhost\comhost.exe

Filesize
84KB

MD5
346a077761ca60cfc77e3b81fbb67a2b

SHA1
97fcfa9357918a3bcf47a0048d54869fd299b84d

SHA256
66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5

SHA512
ab006e92a5657e2483bf622e35b37b6d91cf58d4c6f4e5d41430f71e9c94f1d658d18fb98787b085a1a12955cfc46ec60b62d61b7f754b0b9547566fcb23af2e

Download Submit
C:\Users\Admin\AppData\Roaming\comhost\comhost.exe

Filesize
84KB

MD5
346a077761ca60cfc77e3b81fbb67a2b

SHA1
97fcfa9357918a3bcf47a0048d54869fd299b84d

SHA256
66a73fbca5e330fbcb40fa95115a7b898d07736cebd8916b25583fa22aaff5e5

SHA512
ab006e92a5657e2483bf622e35b37b6d91cf58d4c6f4e5d41430f71e9c94f1d658d18fb98787b085a1a12955cfc46ec60b62d61b7f754b0b9547566fcb23af2e

Download Submit
memory/3312-134-0x0000000000000000-mapping.dmp

Download