d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9

Analysis

max time kernel
28s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 06:25

Target

d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9.exe
Size

6KB
MD5

378deda0d1313deba917adfc74173962
SHA1

cb466cdd64949febdaaae75625d5a3ce0fff6e35
SHA256

d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9
SHA512

c1411ed00aeb88b6f92702132d20dac2efacd90e79aee697e1e0431353638353a5f9fa6b575676e0426f1434cede0f59e58559822cc45067893a30f6b8300281
SSDEEP

96:Ck79rll3VI2St01vk+Al5tONtUqvkC4muMs6d3oj0dirl:J9r/33SCvkRgNtUqvkBmm6dNdq

Score

8^/10

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 936 powershell.exe
5 936 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

936 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 936 powershell.exe

flow	pid	process
4	936	powershell.exe
5	936	powershell.exe

pid	process
936	powershell.exe

description	pid	process
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9.exe

description	pid	process	target process
PID 964 wrote to memory of 936	964	d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9.exe	powershell.exe
PID 964 wrote to memory of 936	964	d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9.exe	powershell.exe
PID 964 wrote to memory of 936	964	d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9.exe
"C:\Users\Admin\AppData\Local\Temp\d34483a5c472119c4edbbf630522a41a9c43ba39bd58b040f5c1eb5e0d76e5a9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:964

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/936-56-0x0000000000000000-mapping.dmp

Download
memory/936-58-0x000007FEF3E90000-0x000007FEF48B3000-memory.dmp

Filesize
10.1MB

Download
memory/936-59-0x000007FEF3330000-0x000007FEF3E8D000-memory.dmp

Filesize
11.4MB

Download
memory/936-60-0x0000000002254000-0x0000000002257000-memory.dmp

Filesize
12KB

Download
memory/936-61-0x000000000225B000-0x000000000227A000-memory.dmp

Filesize
124KB

Download
memory/936-62-0x0000000002254000-0x0000000002257000-memory.dmp

Filesize
12KB

Download
memory/936-63-0x000000000225B000-0x000000000227A000-memory.dmp

Filesize
124KB

Download
memory/936-64-0x0000000002254000-0x0000000002257000-memory.dmp

Filesize
12KB

Download
memory/936-65-0x000000000225B000-0x000000000227A000-memory.dmp

Filesize
124KB

Download
memory/964-54-0x00000000001F0000-0x00000000001F8000-memory.dmp

Filesize
32KB

Download
memory/964-55-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download