42ffdf8098897e4c6eb30bd3b66696d20353fdf882eb2aab7575d17af049471c

Analysis

max time kernel
54s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
16/02/2023, 21:43

Target

EveryonePiano2.1.5.29_setup.exe
Size

5.5MB
MD5

aada3e22e8a48bf5a69e8bb31dcf9553
SHA1

5cb5330b66aeea600b055a57e51fdf1de01edac1
SHA256

42ffdf8098897e4c6eb30bd3b66696d20353fdf882eb2aab7575d17af049471c
SHA512

229e3b7b2f3355574289b1aa71279648fb8a56a0b370efa21ee91ea2bb23ce0125a5856efd63b40719f619b7615b29ee99c21f522c5e78f81904b7ee2efdee85
SSDEEP

98304:iutulTWTfATE1eLCNc8V/cgCzaqp0HZd4iEXxnETN827MvrqQBKUEyE779s2pqQ:bEWT3suNRGUqeHLwxnET2bzqcE7Js2ph

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4792	EveryonePiano2.1.5.29_setup.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4792	4908	EveryonePiano2.1.5.29_setup.exe	80
PID 4908 wrote to memory of 4792	4908	EveryonePiano2.1.5.29_setup.exe	80
PID 4908 wrote to memory of 4792	4908	EveryonePiano2.1.5.29_setup.exe	80

C:\Users\Admin\AppData\Local\Temp\EveryonePiano2.1.5.29_setup.exe
"C:\Users\Admin\AppData\Local\Temp\EveryonePiano2.1.5.29_setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\is-R1NKC.tmp\EveryonePiano2.1.5.29_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R1NKC.tmp\EveryonePiano2.1.5.29_setup.tmp" /SL5="$8004A,5416816,66048,C:\Users\Admin\AppData\Local\Temp\EveryonePiano2.1.5.29_setup.exe"
  2⤵
  - Executes dropped EXE
  PID:4792

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\is-R1NKC.tmp\EveryonePiano2.1.5.29_setup.tmp

Filesize
681KB

MD5
5ca8ae960cca54b8c2ce478bf4e63db8

SHA1
8409d79a25839e1c1074669885a34c48772f604f

SHA256
efd44c917d341cf22639bf880b3cb6e3f416cf7b2e98464123e45e97bbeb7ae4

SHA512
3fdd2dcabaef9cd625566ae540f2ecd3b13f8a90767c076450c875b7d757365f530bed06d152cd6ee5434d3b0ec198e3976c85f8f8bd4751a99c4f3a561cd117

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R1NKC.tmp\EveryonePiano2.1.5.29_setup.tmp

Filesize
681KB

MD5
5ca8ae960cca54b8c2ce478bf4e63db8

SHA1
8409d79a25839e1c1074669885a34c48772f604f

SHA256
efd44c917d341cf22639bf880b3cb6e3f416cf7b2e98464123e45e97bbeb7ae4

SHA512
3fdd2dcabaef9cd625566ae540f2ecd3b13f8a90767c076450c875b7d757365f530bed06d152cd6ee5434d3b0ec198e3976c85f8f8bd4751a99c4f3a561cd117

Download Submit
memory/4908-133-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4908-138-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download