2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187

General

Target

2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
Size

436KB
MD5

443e7ed0727edb29ce9d675363a5f61a
SHA1

d42cdfa00561dc5388426249d87599cf62832be0
SHA256

2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187
SHA512

43e50dd2cfc640264fe5c5bbddc038e9ad0a03be3579b4d7bc190b464a9cd973a2fb9797428e735867490b0bdd0ee222e4dcfdbbad2fda8eda9eb0034901db48
SSDEEP

6144:cXug79j3oQiibsJnh+NwKmRuVUHVazUm3BXXP:ceghj4TGsJnHRsUHVtm3p

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\explorer.exe	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe

pid	process
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe

pid	process
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe

description	pid	process	target process
PID 108 wrote to memory of 980	108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe	explorer.exe
PID 108 wrote to memory of 980	108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe	explorer.exe
PID 108 wrote to memory of 980	108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe	explorer.exe
PID 108 wrote to memory of 980	108	2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe
"C:\Users\Admin\AppData\Local\Temp\2973b0abece062e82696a0ce922471508db14fbb633e764cb1ec24e59a8b3187.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108

\??\c:\windows\SysWOW64\explorer.exe
c:\windows\system32\explorer.exe
2⤵
PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/108-54-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/108-58-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/108-62-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/980-59-0x0000000000000000-mapping.dmp

Download
memory/980-61-0x0000000074B71000-0x0000000074B73000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads