2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf

Analysis

max time kernel
185s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 00:58

Target

2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe
Size

1000KB
MD5

a2cb3c05eeca6c3fb74a55e97227134e
SHA1

3c826530b25e2cf5d409539bcdb88023f12da3c4
SHA256

2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf
SHA512

94f90d3ba79b3cc1c8e775ab8dc1a4eeea084e8cce7467bf40fe24854b4d968499b50b83833c23da4f69dc5995a1dde671f3a2ffe51c046cda6adaf72b1ddfcd
SSDEEP

24576:v/p0Y15t+4j12P1r9minvrhKp0K/Y5sPWdYFeL0DKEWqbKbFMrdJDGih1:3p15VjW0invrbKUvCeQDK1qbCFMrnDz1

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3296	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 3296	3276	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe	83
PID 3276 wrote to memory of 3296	3276	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe	83
PID 3276 wrote to memory of 3296	3276	2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe	83

C:\Users\Admin\AppData\Local\Temp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe
"C:\Users\Admin\AppData\Local\Temp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\is-TVQ9H.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TVQ9H.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp" /SL5="$7003E,763131,52224,C:\Users\Admin\AppData\Local\Temp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.exe"
  2⤵
  - Executes dropped EXE
  PID:3296

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-TVQ9H.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Filesize
660KB

MD5
aa1e9eec51c34d68b3fae2caf4bea3f2

SHA1
ccd2381cff17acbb0adc0c6f409d6df8346c3803

SHA256
2575430608f57e268eb5fc7842aff36bd5506af1d413a02e829920fab72e7e44

SHA512
7ea3747779213df50e3e0b55eae0abb20eeebe20ec8ceb630f8aa93e637889cda7f313c683900748c69e2ee0b66117504fbeee5dbf1ee8e71f096b79b5fa6497

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TVQ9H.tmp\2556bbda748eb2ea6174f6eae7398da2b0f555666ab7b4239bd6120bffec5fcf.tmp

Filesize
660KB

MD5
aa1e9eec51c34d68b3fae2caf4bea3f2

SHA1
ccd2381cff17acbb0adc0c6f409d6df8346c3803

SHA256
2575430608f57e268eb5fc7842aff36bd5506af1d413a02e829920fab72e7e44

SHA512
7ea3747779213df50e3e0b55eae0abb20eeebe20ec8ceb630f8aa93e637889cda7f313c683900748c69e2ee0b66117504fbeee5dbf1ee8e71f096b79b5fa6497

Download Submit
memory/3276-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3276-134-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3276-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download