4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 01:59

Target

4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
Size

307KB
MD5

cfc76cf1dd083e20811d0f2b2065659c
SHA1

98615fb125439748dbcd41c7e00aa4cacb2bed1d
SHA256

4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6
SHA512

22d5c97a76e8a2101a25effd0a569de51eaca7dadedf1e0a00101a4d9565512375a006dc25d27499a919576b9c0349b78ad4fd085658cf2939e30c54d4411f01
SSDEEP

3072:NQUmZVX/L7wxxxfrjPUs7QQKYpOzn1nUn1SBlwbYEnb:NmXz7w7xzjPUyQjYpOz1UnkARnb

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe

description	pid	process	target process
PID 2036 wrote to memory of 1984	2036	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
PID 2036 wrote to memory of 1984	2036	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
PID 2036 wrote to memory of 1984	2036	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
PID 2036 wrote to memory of 1984	2036	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
PID 2036 wrote to memory of 1984	2036	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
PID 2036 wrote to memory of 1984	2036	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
PID 2036 wrote to memory of 1984	2036	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe	4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe

C:\Users\Admin\AppData\Local\Temp\4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
"C:\Users\Admin\AppData\Local\Temp\4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Users\Admin\AppData\Local\Temp\4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe
"C:\Users\Admin\AppData\Local\Temp\4912c72d9e956e968cd86916fecb1ea5c2f1da5fb78ce2e603111cad571297d6.exe" ADMIN
2⤵
PID:1984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1984-55-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download