b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 19:27

Target

b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe
Size

2.7MB
MD5

cc659c5862e7d1930dcb47dd11a7e178
SHA1

6a9971919d7da42673876007be393fa18155a30f
SHA256

b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7
SHA512

46fd2ac20c7009f1b43a56ffc4ff16587fa3099b7e13eb1e68f1e8bc8622520b58b46e8b70461f6234880526333ee40584b696a117402a724db0b83e7eb15e0e
SSDEEP

49152:kGU6QNADYFM9klsMwZfoikxZNS0Cu1EAP0Pre2ksomJqMIY0ng91LGSDsEyizNx6:ZU3yYeSsMOkbLCz+2k4AnuLGM1r6

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
5004	is-7JQBR.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 5004	3144	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	80
PID 3144 wrote to memory of 5004	3144	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	80
PID 3144 wrote to memory of 5004	3144	b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe	80

C:\Users\Admin\AppData\Local\Temp\b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe
"C:\Users\Admin\AppData\Local\Temp\b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\is-H609V.tmp\is-7JQBR.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-H609V.tmp\is-7JQBR.tmp" /SL4 $A0048 "C:\Users\Admin\AppData\Local\Temp\b665e81d66ce83bc7d0504d7f052b302d91db742fb2266d0b4bd80735074a2d7.exe" 2610169 51200
  2⤵
  - Executes dropped EXE
  PID:5004

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-H609V.tmp\is-7JQBR.tmp

Filesize
649KB

MD5
897787d6abd66a5f10927d8fb6645f55

SHA1
f6106753adb23afd105e3b677f8b6c005812e850

SHA256
a68a96927d72c5a0be27b3a9c6a70f35c4c495167e76813a81febe586d547c1f

SHA512
7488348ddf93c3251321db47bda22be0df18aeff0d407c1cfb483855be724cc333b212810c4123a672bd2e70cc2734a83f952c24f553dbfeacd14d48f922262c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-H609V.tmp\is-7JQBR.tmp

Filesize
649KB

MD5
897787d6abd66a5f10927d8fb6645f55

SHA1
f6106753adb23afd105e3b677f8b6c005812e850

SHA256
a68a96927d72c5a0be27b3a9c6a70f35c4c495167e76813a81febe586d547c1f

SHA512
7488348ddf93c3251321db47bda22be0df18aeff0d407c1cfb483855be724cc333b212810c4123a672bd2e70cc2734a83f952c24f553dbfeacd14d48f922262c

Download Submit
memory/3144-132-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3144-134-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3144-138-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download