7be7c55b508491fc120da9f6e3390bd35f97c234088a1d512bc0209fe700cff2

Analysis

max time kernel
121s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2023, 04:06

Target
Invoice No 3031.exe
Size 392KB
Sample230419-epaltagb72
SHA256 30dfdf5dc70837a7d9a22bb1128100ba462ef69d3cf97eaa65e7104dd19ce6d7
MD5 834d27a3338f27c774f1ac360bd811a2
SHA1 8b7c89a775b2cbe13b254ca062eea65f7c2ac6d6
SHA512 64b75de52045819d4579c3fc35dd8364669f3564ae3aea63a939bf38f6f85636fe3b9aa719969989b9f4f1d91e1366b329ddd270aae60e5b3f091de46bd09c08
SSDEEP 6144:NioDjSNztkmcu1S4GlA9jmHv/VCSY3hw9lMbk6u1QMS0y+lqiHTonWryFDYR:wK46A9jmP/uhu/yMS08CkntxYR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 688	432	Invoice No 3031.exe	82
PID 432 wrote to memory of 688	432	Invoice No 3031.exe	82
PID 432 wrote to memory of 688	432	Invoice No 3031.exe	82

C:\Users\Admin\AppData\Local\Temp\Invoice No 3031.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice No 3031.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:688

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact