b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd

Analysis

max time kernel
41s
max time network
61s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 12:02

Target

b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe
Size

121KB
MD5

0d2bf41ed57646c4181e85b29cc39de1
SHA1

e6d3ff7a57489a5e15361257de7d47052fac0b75
SHA256

b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd
SHA512

dd939077c4f52143c3659e79b4d469a174042b339b1e56dd867547a39745d4a3138486a7a734af24d938948a6aabe80f6e1033fee0679aca2aa0d53c20f61260
SSDEEP

3072:jzNWMKKRZYchObK91C8sV6Xmoo4L2SSTJK5i3:jZuuObR8sVImc2SSTJp3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 984	1284	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe	27
PID 1284 wrote to memory of 984	1284	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe	27
PID 1284 wrote to memory of 984	1284	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe	27
PID 1284 wrote to memory of 984	1284	b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe	27

C:\Users\Admin\AppData\Local\Temp\b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe
"C:\Users\Admin\AppData\Local\Temp\b854e44ebc6ee7c0b09a561f20fb9437da01f2815d25a8c314ac773573c844cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\jagi.jpg.vbs"
  2⤵
  PID:984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\jagi.jpg.vbs

Filesize
4KB

MD5
8285f979380bc9f61f9613d9b04fb938

SHA1
f3ac8de375dfb2403b64bd161c6485365ff31b69

SHA256
daba03a6b029e8482d3dc4d9bbe7f65b920c89449625080694e6965ad34ff4a5

SHA512
42455307ce282a1323c7c7eb2454acf1b8b176a8d6ab63905431b6315f80b7209570896b488d57a46f4a8854270faafb2c1c7ced2d35e9de0e90d423726b165a

Download Submit
memory/1284-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1284-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1284-59-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download