02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00

Analysis

max time kernel
177s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 06:23

Target

02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.exe
Size

2.7MB
MD5

0dd1629a854c075f0196293fd502128a
SHA1

21d5fdbaad5c7ae8cff853be17785f0f499787be
SHA256

02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00
SHA512

a497aab787483a2f98ee27abfea1c62e002547869cac02ca1e7cc0890469502f73754a27329823815427b089bbb3c53fc36523438a596c0873e32dd5444334ed
SSDEEP

49152:F9Cztl8hEUkc+4cM/AaaVViUxcqwm8yG1aGjJlA54VQzsD5sMvHxVcL:FQzTIENf4zAauDxBP3AjJe54QQ5scXcL

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
1756	02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1756	2088	02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.exe	84
PID 2088 wrote to memory of 1756	2088	02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.exe	84
PID 2088 wrote to memory of 1756	2088	02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.exe	84

C:\Users\Admin\AppData\Local\Temp\02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.exe
"C:\Users\Admin\AppData\Local\Temp\02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\is-D3KEU.tmp\02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D3KEU.tmp\02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.tmp" /SL5="$B01DA,2532446,51712,C:\Users\Admin\AppData\Local\Temp\02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.exe"
  2⤵
  - Executes dropped EXE
  PID:1756

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-D3KEU.tmp\02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.tmp

Filesize
673KB

MD5
0c02cf86286d39cf6f69a3fc62176c56

SHA1
d81178726be705a81d769c1c9886c3f79827ff64

SHA256
1907c2750c21324d13b107f07f2cad70cc52c016ce69104a5e05f8d174505d57

SHA512
3b88b12cde18e88c046fb82dc2cbf96d15af492b746867848366bdf223988e761537e389dc60c37a141a5634f173ad8cdec9efc0cb162d5a6c6b8cc631702f7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D3KEU.tmp\02a6d77283baba89d6a4861a7caa3ac763567ec933013ad05a7239d0953e2f00.tmp

Filesize
673KB

MD5
0c02cf86286d39cf6f69a3fc62176c56

SHA1
d81178726be705a81d769c1c9886c3f79827ff64

SHA256
1907c2750c21324d13b107f07f2cad70cc52c016ce69104a5e05f8d174505d57

SHA512
3b88b12cde18e88c046fb82dc2cbf96d15af492b746867848366bdf223988e761537e389dc60c37a141a5634f173ad8cdec9efc0cb162d5a6c6b8cc631702f7d

Download Submit
memory/2088-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2088-137-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2088-138-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download