adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91

Analysis

max time kernel
93s
max time network
184s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
24/11/2022, 04:39

Target

adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91.exe
Size

2.2MB
MD5

e6992d46c9abf60e3d9d65fa0b2be6d1
SHA1

ab3ed24232c7ac2a7b8e15732236e9da65381971
SHA256

adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91
SHA512

9667b01443b4f938400392b198959aebd9b3610f57798734dfed44b36e2b4a3927b219b102aad2e569ba29d31146cba68a9c10c95580e95309c992439809c5f3
SSDEEP

49152:8c//////ZTNDFcaptbqKOcq3JxA78Sekx4scI2tcre+S8NOHf0fItywN6E9ikv/u:8c//////5lHDJm8V/cRtJ375tPN6E/vG

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 1400	936	adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91.exe	28
PID 936 wrote to memory of 1400	936	adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91.exe	28
PID 936 wrote to memory of 1400	936	adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91.exe	28
PID 936 wrote to memory of 1400	936	adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91.exe	28

C:\Users\Admin\AppData\Local\Temp\adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91.exe
"C:\Users\Admin\AppData\Local\Temp\adf1ab30812c86898909ee71608305e21687ddb6466fb75cd06d07377f363a91.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "C:\Users\Admin\AppData\Local\Temp\CFºì³¾[ÌåÑéÒ»Çø]È«ÄÜ±äÌ¬¸¨ÖúBeta£º80.zip"
  2⤵
  PID:1400

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1400-55-0x0000000076391000-0x0000000076393000-memory.dmp

Filesize
8KB

Download
memory/1400-56-0x0000000074701000-0x0000000074703000-memory.dmp

Filesize
8KB

Download