c2bf26d1b3a311be1bec839ca7c26bf2c944fd79333485a271230ec435c318dd

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02-03-2024 20:19

Target

Ransomware/Atom Payload Builder.exe
Size

513KB
MD5

224db51b372a5a26f3e09d2a64af50b2
SHA1

bca07e1a05bc30bbf51ccfdc34676fc574b790d7
SHA256

5ab04878b630d1e0598fb6f74570f653a6bd0753dad9ef55ecf467bee7e618e1
SHA512

f031ee3a4307bddffcf9809f3e4d778a5f8ebe1d53ba8fde13bd1c6248e93e8e479ddb21dca9a201aaa261c4111eee2c21a241fbe3087f9eb777bccc542163de
SSDEEP

12288:amhp5zFkcxdQ8r0R3gYR3nxdJYEm5ATgulc/:3BZoR3gYR3nFmBulc

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	Atom Payload Builder.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 3024	1284	Atom Payload Builder.exe	28
PID 1284 wrote to memory of 3024	1284	Atom Payload Builder.exe	28
PID 1284 wrote to memory of 3024	1284	Atom Payload Builder.exe	28

C:\Users\Admin\AppData\Local\Temp\Ransomware\Atom Payload Builder.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware\Atom Payload Builder.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1284 -s 624
  2⤵
  PID:3024

memory/1284-0-0x0000000000860000-0x00000000008E8000-memory.dmp

Filesize
544KB

Download
memory/1284-1-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/1284-2-0x000000001B2B0000-0x000000001B330000-memory.dmp

Filesize
512KB

Download
memory/1284-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1284-4-0x0000000000330000-0x000000000038C000-memory.dmp

Filesize
368KB

Download
memory/1284-5-0x000000001A780000-0x000000001A816000-memory.dmp

Filesize
600KB

Download
memory/1284-6-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/1284-7-0x000000001B2B0000-0x000000001B330000-memory.dmp

Filesize
512KB

Download