7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70

Analysis

max time kernel
47s
max time network
110s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 18:34

Target

7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe
Size

421KB
MD5

5a17617b9195a2a3ee85013db0a10a8f
SHA1

0ec243fce4a74ab684b8dbab180c5207c3c694e0
SHA256

7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70
SHA512

388e5983bb3649f2d13c79310917e5584b2f1b4c4edc4056ab56dceaa83767a83a5b37cb224f8a3e3b1d77508b5c6109d14812da7978decb2a30db798ff04374
SSDEEP

12288:qyr7k7uTe6HVB1VFgKh2szxr5G4w1lo3pj:phaCT1VFgKAGJhp5j

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1172	1448	7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe	30
PID 1448 wrote to memory of 1172	1448	7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe	30
PID 1448 wrote to memory of 1172	1448	7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe	30
PID 1448 wrote to memory of 1172	1448	7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe	30
PID 1448 wrote to memory of 1172	1448	7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe	30
PID 1448 wrote to memory of 1172	1448	7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe	30
PID 1448 wrote to memory of 1172	1448	7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe	30

C:\Users\Admin\AppData\Local\Temp\7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe
"C:\Users\Admin\AppData\Local\Temp\7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe
  "C:\Users\Admin\AppData\Local\Temp\7c7ff18aee0641bc35d50076ef2098119afe92f41c30a8be88c614d66353dc70.exe" ADMIN
  2⤵
  PID:1172

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1448-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download