70d01c6918c07b4cd0daa9b2c688fbd7e0e2e6f77831c9bd351be29a7991e1d3

Analysis

max time kernel
123s
max time network
54s
platform
windows7_x64
resource
win7v20210408
submitted
02/10/2021, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9a745c32c2018a757b999cc46ab1f4cc.exe
Size 341KB
Sample211002-tcsdesefbl
SHA256 70d01c6918c07b4cd0daa9b2c688fbd7e0e2e6f77831c9bd351be29a7991e1d3
MD5 9a745c32c2018a757b999cc46ab1f4cc
SHA1 18519bc309e8d7582f7840a2ff1b4f12efb54e30
SHA512 4ba70a6563b72073cf00bef79f3c6df1347faf6fd9ea7c69e6eb43e849b1f997a5935e4d290e7ae36ff26dcd28c0793a5e67a4b90ebd2d34d4d5c9600644e423
MD5 SHA1 SHA512

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1920	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9a745c32c2018a757b999cc46ab1f4cc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9a745c32c2018a757b999cc46ab1f4cc.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1972	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1920	604	9a745c32c2018a757b999cc46ab1f4cc.exe	25
PID 604 wrote to memory of 1920	604	9a745c32c2018a757b999cc46ab1f4cc.exe	25
PID 604 wrote to memory of 1920	604	9a745c32c2018a757b999cc46ab1f4cc.exe	25
PID 604 wrote to memory of 1920	604	9a745c32c2018a757b999cc46ab1f4cc.exe	25
PID 1920 wrote to memory of 1972	1920	cmd.exe	27
PID 1920 wrote to memory of 1972	1920	cmd.exe	27
PID 1920 wrote to memory of 1972	1920	cmd.exe	27
PID 1920 wrote to memory of 1972	1920	cmd.exe	27

C:\Users\Admin\AppData\Local\Temp\9a745c32c2018a757b999cc46ab1f4cc.exe
"C:\Users\Admin\AppData\Local\Temp\9a745c32c2018a757b999cc46ab1f4cc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\ipXAIdZbCINS & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9a745c32c2018a757b999cc46ab1f4cc.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-59-0x0000000075211000-0x0000000075213000-memory.dmp

Download

memory/604-60-0x00000000002E0000-0x0000000000326000-memory.dmp

Download

memory/604-61-0x0000000000400000-0x0000000000885000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads