3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2

General

Target

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
Size

871KB
MD5

456cb427ed04d5b9d8adb418cc9c3d10
SHA1

44e1712f57332311c3095fe3f6711fa61afebc19
SHA256

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2
SHA512

12a7668263ea91d41e7750513d7f74ce5189470e4e82b6ce344d9c740deff1a06b4053a53e9df2ce37792f74b67023fe6a9b13d0651ef35b9c715106d364cca3
SSDEEP

12288:aaWzgMg7v3qnCiMErQohh0F4CCJ8lny/QACTI2IO6X4SehZuvnKPmxFbyJ:VaHMv6Corjqny/QACEm6XqhZMnKufeJ

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

description	pid	process	target process
PID 4984 set thread context of 3260	4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 set thread context of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid	process
4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid	process
4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid process

3260 3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

pid	process
3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

description	pid	process	target process
PID 4984 wrote to memory of 3260	4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 4984 wrote to memory of 3260	4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 4984 wrote to memory of 3260	4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 4984 wrote to memory of 3260	4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 4984 wrote to memory of 3260	4984	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 wrote to memory of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 wrote to memory of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 wrote to memory of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 wrote to memory of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 wrote to memory of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 wrote to memory of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
PID 3260 wrote to memory of 696	3260	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe	3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe

C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
"C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984

C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
"C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3260

C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe
"C:\Users\Admin\AppData\Local\Temp\3c07b81515f0e6ba239a8ead2d2f73b79bbe0de97dde6832fe559766492ea5e2.exe"
3⤵
PID:696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/696-137-0x0000000000000000-mapping.dmp

Download
memory/696-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/696-141-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/696-142-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3260-132-0x0000000000000000-mapping.dmp

Download
memory/3260-133-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3260-140-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads