3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2

General

Target

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
Size

871KB
MD5

456cb427ed04d5b9d8adb418cc9c3d10
SHA1

44e1712f57332311c3095fe3f6711fa61afebc19
SHA256

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2
SHA512

12a7668263ea91d41e7750513d7f74ce5189470e4e82b6ce344d9c740deff1a06b4053a53e9df2ce37792f74b67023fe6a9b13d0651ef35b9c715106d364cca3
SSDEEP

12288:aaWzgMg7v3qnCiMErQohh0F4CCJ8lny/QACTI2IO6X4SehZuvnKPmxFbyJ:VaHMv6Corjqny/QACEm6XqhZMnKufeJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

description	pid	process	target process
PID 304 set thread context of 2008	304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 set thread context of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid	process
304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid	process
304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid process

2008 3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid	process
2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

description	pid	process	target process
PID 304 wrote to memory of 2008	304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 304 wrote to memory of 2008	304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 304 wrote to memory of 2008	304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 304 wrote to memory of 2008	304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 304 wrote to memory of 2008	304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 304 wrote to memory of 2008	304	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 2008 wrote to memory of 1980	2008	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
"C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:304

C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
"C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
"C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe"
3⤵
PID:1980

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/304-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1980-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1980-63-0x0000000000407A4D-mapping.dmp

Download
memory/1980-66-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1980-68-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1980-70-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2008-55-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2008-58-0x0000000000401360-mapping.dmp

Download
memory/2008-57-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2008-64-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2008-67-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads