2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472

Analysis

max time kernel
45s
max time network
87s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 00:08

Target

2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe
Size

171KB
MD5

34b0fdc3265c869d8f15ea8f715403f8
SHA1

088cdb2b544bc6330bc9074890db5a9ba71d15c0
SHA256

2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472
SHA512

c7a056b1ebdf2d3bfd930d7450e7f97e01f7f00168d3ef7ae84ac711d515a1b891cda4ef8979b5904638e4b495b0b9f1a75ddad6bdc266cef1f9bc4fe7d9d645
SSDEEP

3072:81Lv5af0Pg/NPg/9Pg/qPg/V+yO7xkTGD4eCc+88srH8HnjbqocVL+yO7xkTGD4Q:8ZPcPEP7PkxO7xkTGD4eCc+88srH8At8

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

756 tasklist.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tasklist.exe

description pid process

Token: SeDebugPrivilege 756 tasklist.exe

pid	process
756	tasklist.exe

description	pid	process
Token: SeDebugPrivilege	756	tasklist.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe

pid	process
1232	2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe
1232	2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.execmd.exe

description	pid	process	target process
PID 1232 wrote to memory of 1824	1232	2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe	cmd.exe
PID 1232 wrote to memory of 1824	1232	2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe	cmd.exe
PID 1232 wrote to memory of 1824	1232	2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe	cmd.exe
PID 1232 wrote to memory of 1824	1232	2c626f914f6450a076761264fcc90a88557f048abdf2bf0427f3ddeb6ead4472.exe	cmd.exe
PID 1824 wrote to memory of 756	1824	cmd.exe	tasklist.exe
PID 1824 wrote to memory of 756	1824	cmd.exe	tasklist.exe
PID 1824 wrote to memory of 756	1824	cmd.exe	tasklist.exe
PID 1824 wrote to memory of 756	1824	cmd.exe	tasklist.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del 2c626f914f6450a076761264fcc90a8855
2⤵
- Suspicious use of WriteProcessMemory
PID:1824

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/756-60-0x0000000000000000-mapping.dmp

Download
memory/1232-57-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1232-58-0x0000000004310000-0x0000000004DCA000-memory.dmp

Filesize
10.7MB

Download
memory/1824-59-0x0000000000000000-mapping.dmp

Download