d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262

General

Target

d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
Size

215KB
MD5

55e68fb217f68e35470e0ce15b06c326
SHA1

963c109a22537a709094ee51461aa550d3989d35
SHA256

d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262
SHA512

e4a0a72000e746e190161c552dab8994369d87dca3e933ca21d1c7449c0dfc5a031f678c5a31a5c288d713dce3c913f1a4fa46ddb01e820554cdf028b27ea4be
SSDEEP

6144:3MgV3XC1RdXyLK53SVBJMxzPq3HT1Zvh4kD0DiYgP6yh:cOCbdXyBBJIzPq3HT1Zvh4kD0DiYgP6G

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe

description	ioc	process
File opened for modification	\??\c:\windows\SysWOW64\explorer.exe	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe

pid	process
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe

pid	process
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe

description	pid	process	target process
PID 2040 wrote to memory of 572	2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe	explorer.exe
PID 2040 wrote to memory of 572	2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe	explorer.exe
PID 2040 wrote to memory of 572	2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe	explorer.exe
PID 2040 wrote to memory of 572	2040	d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe	explorer.exe

C:\Users\Admin\AppData\Local\Temp\d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe
"C:\Users\Admin\AppData\Local\Temp\d6b283b1f81525367aed581c15a4f5cb6e6905e4749b08549d39c98f3a0c8262.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

\??\c:\windows\SysWOW64\explorer.exe
c:\windows\system32\explorer.exe
2⤵
PID:572

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-58-0x0000000000000000-mapping.dmp

Download
memory/572-60-0x0000000074D21000-0x0000000074D23000-memory.dmp

Filesize
8KB

Download
memory/2040-57-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads