Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07/02/2022, 21:29
Behavioral task
behavioral1
Sample
98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe
-
Size
70KB
-
MD5
083747a495f42e4d89c6f6640ddc0397
-
SHA1
8a7f3873596c48b5b454daeee7fa160f551c239f
-
SHA256
98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d
-
SHA512
1c47cf2bf8b9de2fb180bfe81856b5e9d104f62eda88e1355ffead972029eb79abcf26de40ad61c373b42271b7713d402ec50cf20123f1d0ef2f0bc34c995938
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1428 1652 98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe 27 PID 1652 wrote to memory of 1428 1652 98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe 27 PID 1652 wrote to memory of 1428 1652 98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe 27 PID 1652 wrote to memory of 1428 1652 98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe"C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1CB4.tmp\1CF4.bat C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe"2⤵PID:1428
-