599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6

Analysis

max time kernel
152s
max time network
187s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 06:25

Target

599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6.exe
Size

6KB
MD5

224ad38879a55ecc379737225d02b85c
SHA1

260cfe1499c16b381698a462f0997b105add2e9d
SHA256

599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6
SHA512

fd781fee26055eeb4eed26058146a5423684543099313c8d6f6c4f157e6484c89cc2d7180f5b82555ce5eb194e595bbb5ce4da8f3e0eba7b1bca27a2a66ce335
SSDEEP

96:I8J79BlBCF5NTcofNVIIKtgNtUqpkK77mc359ed3ojXrl:z9BuFDNNVI5ONtUqpkK77Rzeda

Score

8^/10

Blocklisted process makes network request 4 IoCs

Processes:

powershell.exe

flow pid process

5 472 powershell.exe
6 472 powershell.exe
7 472 powershell.exe
10 472 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

472 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 472 powershell.exe

pid	process
472	powershell.exe

description	pid	process
Token: SeDebugPrivilege	472	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6.exe

description	pid	process	target process
PID 1076 wrote to memory of 472	1076	599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6.exe	powershell.exe
PID 1076 wrote to memory of 472	1076	599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6.exe	powershell.exe
PID 1076 wrote to memory of 472	1076	599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6.exe
"C:\Users\Admin\AppData\Local\Temp\599e17a85afe5abfc5e7f0210a5d76241bc5304d4ff1fd6f5376bd2aa859a3c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/472-56-0x0000000000000000-mapping.dmp

Download
memory/472-58-0x000007FEF3F50000-0x000007FEF4973000-memory.dmp

Filesize
10.1MB

Download
memory/472-59-0x000007FEF33F0000-0x000007FEF3F4D000-memory.dmp

Filesize
11.4MB

Download
memory/472-60-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/472-61-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/472-62-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/472-63-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/1076-54-0x0000000000EA0000-0x0000000000EA8000-memory.dmp

Filesize
32KB

Download
memory/1076-55-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmp

Filesize
8KB

Download