Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    07/02/2022, 21:29

General

  • Target

    98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe

  • Size

    70KB

  • MD5

    083747a495f42e4d89c6f6640ddc0397

  • SHA1

    8a7f3873596c48b5b454daeee7fa160f551c239f

  • SHA256

    98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d

  • SHA512

    1c47cf2bf8b9de2fb180bfe81856b5e9d104f62eda88e1355ffead972029eb79abcf26de40ad61c373b42271b7713d402ec50cf20123f1d0ef2f0bc34c995938

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe
    "C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1CB4.tmp\1CF4.bat C:\Users\Admin\AppData\Local\Temp\98622f07ac2af01cf2629d2fee6f470ab8179b7d42eb3f864e7fde49565e844d.exe"
      2⤵
        PID:1428

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1652-55-0x0000000076641000-0x0000000076643000-memory.dmp

            Filesize

            8KB