c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52

Analysis

max time kernel
16s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 10:41

Target

c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe
Size

3.2MB
MD5

44814969aa47a29a19ccf7ca9b2ca90c
SHA1

d48ba6bda56f81b386562d11a112aaf7aa5c6ae4
SHA256

c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52
SHA512

2e06ff06ab7049ec92da0f975fdb4cbafe06936031d4a16baca27207b22b7badc2190d24af7316e852a39b7e88754be0c8ba4bd0424fb57afef3dc498512f229
SSDEEP

49152:fzi2s06WmGTEUK3buXSs4W2GFa16GvaT5a44mSseemnvZ9HjzEYFMM15f5J:fziRRJruXmuiaT5a45SOmnL0YH/f5J

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 328	2028	c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe	28
PID 2028 wrote to memory of 328	2028	c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe	28
PID 2028 wrote to memory of 328	2028	c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe	28
PID 2028 wrote to memory of 328	2028	c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe	28
PID 2028 wrote to memory of 328	2028	c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe	28
PID 2028 wrote to memory of 328	2028	c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe	28
PID 2028 wrote to memory of 328	2028	c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe	28
PID 328 wrote to memory of 560	328	Net.exe	30
PID 328 wrote to memory of 560	328	Net.exe	30
PID 328 wrote to memory of 560	328	Net.exe	30
PID 328 wrote to memory of 560	328	Net.exe	30
PID 328 wrote to memory of 560	328	Net.exe	30
PID 328 wrote to memory of 560	328	Net.exe	30
PID 328 wrote to memory of 560	328	Net.exe	30

C:\Users\Admin\AppData\Local\Temp\c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe
"C:\Users\Admin\AppData\Local\Temp\c61cbffdd3532211fe3f20c1928ea2655b0b9e11f621c1135e3bc09d03af6f52.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\Net.exe
  Net Stop PcaSvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:328
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 Stop PcaSvc
    3⤵
    PID:560

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/328-55-0x0000000000000000-mapping.dmp

Download
memory/560-57-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download