db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e

Analysis

max time kernel
9s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 20:36

Target

db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e.exe
Size

1.1MB
MD5

26534ada5d30b7db34aebd3079e93f0f
SHA1

97b1d73ac20f4fa9a236e0147bbd1bb38d35dfbd
SHA256

db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e
SHA512

06bf16e9e14890404abdbc47e22479c9a35c859312f452f2ddf82d082fe9681ec7f984a21fd94cae5517a97dabd2c4b777d94b335acbd24b7db0a98392c7251b
SSDEEP

24576:BI39davyd0mBbWYXT3zkm0jyJ1norwfYEghJahRjQm:B6daZiZXLzB0oVEEghJyd

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3928	is-BVUJK.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3928	1404	db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e.exe	75
PID 1404 wrote to memory of 3928	1404	db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e.exe	75
PID 1404 wrote to memory of 3928	1404	db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e.exe	75

C:\Users\Admin\AppData\Local\Temp\db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e.exe
"C:\Users\Admin\AppData\Local\Temp\db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\is-4GAMJ.tmp\is-BVUJK.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4GAMJ.tmp\is-BVUJK.tmp" /SL4 $F0062 "C:\Users\Admin\AppData\Local\Temp\db2f74bb6365551b8ef9e64be6167e2fdc86127e3c472b9fa8cfe0b5666a6e9e.exe" 927749 72704
  2⤵
  - Executes dropped EXE
  PID:3928

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-4GAMJ.tmp\is-BVUJK.tmp

Filesize
656KB

MD5
69c66d1add37a646768cebcc958596c2

SHA1
c2018243dfe654bc70b9eefd9069b91be914406b

SHA256
4924545a8983a732951cc5c99a6b0365e5d98ad5f655e9abb3770031a8b3af6f

SHA512
ab59bcf5b9d1ebfedb5e4e90bf37164d7273329ce198acce5f0f2d1b5f03c7c5f244842a4fa281974aeaa90e7c3462ac1a6a864b6d5b2f2af033858c3b4ecc25

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4GAMJ.tmp\is-BVUJK.tmp

Filesize
656KB

MD5
69c66d1add37a646768cebcc958596c2

SHA1
c2018243dfe654bc70b9eefd9069b91be914406b

SHA256
4924545a8983a732951cc5c99a6b0365e5d98ad5f655e9abb3770031a8b3af6f

SHA512
ab59bcf5b9d1ebfedb5e4e90bf37164d7273329ce198acce5f0f2d1b5f03c7c5f244842a4fa281974aeaa90e7c3462ac1a6a864b6d5b2f2af033858c3b4ecc25

Download Submit
memory/1404-132-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1404-136-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download