8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b

Analysis

max time kernel
52s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 21:21

Target

8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe
Size

262KB
MD5

e135ee0d7cecb3fd6707fe9ab0cd2daa
SHA1

aaa5f0aa8fa6b90b2eea0899d338f0f7556a5012
SHA256

8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b
SHA512

986265efdc1d9c265d60a2d5eb63a31e3351ac2d22870247880da4eb94c500623d6189e7825c13f5b203929c9ed28fce86b88d3f0742f0eca127141c2306f528
SSDEEP

6144:n5mts+yZ2zxvsr6Jj8fjvA7sG8jaBkj2p0JwaNnRSChs8bEOsgX88xAlg:nE6Z2zx0wj8fjvWN8+30Jw2RMIJQg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 324	1140	8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe	29
PID 1140 wrote to memory of 324	1140	8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe	29
PID 1140 wrote to memory of 324	1140	8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe	29
PID 1140 wrote to memory of 324	1140	8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe	29
PID 1140 wrote to memory of 324	1140	8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe	29
PID 1140 wrote to memory of 324	1140	8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe	29
PID 1140 wrote to memory of 324	1140	8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe	29

C:\Users\Admin\AppData\Local\Temp\8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe
"C:\Users\Admin\AppData\Local\Temp\8decf87a663d311aa46bee80e940f83daaa28cc788410f79bfbd9b80aead116b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /u /s "C:\Program Files (x86)\RelevantKnowledge\rlls.dll"
  2⤵
  PID:324

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1140-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1140-55-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1140-56-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1140-57-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1140-60-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download