29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422

Analysis

max time kernel
170s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:40

Target

29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe
Size

18KB
MD5

9de1c02cb8f6203bcf3b6f79962adb7b
SHA1

79b9d852150ce8504cd9e1a0a8fbab8f85c06903
SHA256

29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422
SHA512

c3663475e1f25351b4ec6587e85549da74a72ee1d07d286c0d0d8b368a42f8a807995e5e31e34397e860c2712f0ff1ffd848d523313d744e10422ead18d8285b
SSDEEP

192:K790pylszn3MPFjuOZrCZ047a1oyn361miLMgepar8Vd/d:s2pzn4sOZrCv7a18wiLMge68VdV

Score

8^/10

Executes dropped EXE 1 IoCs

Processes:

vytkz.exe

pid process

1716 vytkz.exe
Loads dropped DLL 1 IoCs

Processes:

29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe

pid process

1772 29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1716	vytkz.exe

pid	process
1772	29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe

description	pid	process	target process
PID 1772 wrote to memory of 1716	1772	29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe	vytkz.exe
PID 1772 wrote to memory of 1716	1772	29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe	vytkz.exe
PID 1772 wrote to memory of 1716	1772	29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe	vytkz.exe
PID 1772 wrote to memory of 1716	1772	29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe	vytkz.exe

C:\Users\Admin\AppData\Local\Temp\29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe
"C:\Users\Admin\AppData\Local\Temp\29f5b14e969311a2b17e53f72105316671680837cec9f53c7520fe0775807422.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\vytkz.exe
  "C:\Users\Admin\AppData\Local\Temp\vytkz.exe"
  2⤵
  - Executes dropped EXE
  PID:1716

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\vytkz.exe

Filesize
18KB

MD5
1b2bcebf800adb80593fa48b97e2059f

SHA1
3bfde8d14bd57e86690841e908437dd9bf99f345

SHA256
4c91fcacff59167d74af7e04887b462ca31bc0481ebe5deca78b84790cc20ed0

SHA512
acb6d9235eef696d2735219e32bd51d83b129df5ff1c2759719918af5978063997d995de6f5e80c7aff100dfaf2cac5a48210e21b77a7dc184ef2f1be1306377

Download Submit
C:\Users\Admin\AppData\Local\Temp\vytkz.exe

Filesize
18KB

MD5
1b2bcebf800adb80593fa48b97e2059f

SHA1
3bfde8d14bd57e86690841e908437dd9bf99f345

SHA256
4c91fcacff59167d74af7e04887b462ca31bc0481ebe5deca78b84790cc20ed0

SHA512
acb6d9235eef696d2735219e32bd51d83b129df5ff1c2759719918af5978063997d995de6f5e80c7aff100dfaf2cac5a48210e21b77a7dc184ef2f1be1306377

Download Submit
\Users\Admin\AppData\Local\Temp\vytkz.exe

Filesize
18KB

MD5
1b2bcebf800adb80593fa48b97e2059f

SHA1
3bfde8d14bd57e86690841e908437dd9bf99f345

SHA256
4c91fcacff59167d74af7e04887b462ca31bc0481ebe5deca78b84790cc20ed0

SHA512
acb6d9235eef696d2735219e32bd51d83b129df5ff1c2759719918af5978063997d995de6f5e80c7aff100dfaf2cac5a48210e21b77a7dc184ef2f1be1306377

Download Submit
memory/1716-57-0x0000000000000000-mapping.dmp

Download
memory/1716-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1772-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/1772-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download