Analysis
-
max time kernel
123s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07/02/2022, 05:00
Behavioral task
behavioral1
Sample
44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe
Resource
win10v2004-en-20220113
0 signatures
0 seconds
General
-
Target
44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe
-
Size
64KB
-
MD5
fedaf9011bcbf1e7589e6f2289af7fa5
-
SHA1
9485c10542340a511a149443609d6b3cf44ae512
-
SHA256
44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d
-
SHA512
acae22ec7fb509b8eb22ed1196eabef70803402981247686d052d027f9b9e04fbd2eacbe366cc763600821cc1e55ced01ffdae6fb5a262a4282292592884da13
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1616 wrote to memory of 1540 1616 44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe 27 PID 1616 wrote to memory of 1540 1616 44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe 27 PID 1616 wrote to memory of 1540 1616 44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe 27 PID 1616 wrote to memory of 1540 1616 44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe 27 PID 1540 wrote to memory of 1028 1540 cmd.exe 29 PID 1540 wrote to memory of 1028 1540 cmd.exe 29 PID 1540 wrote to memory of 1028 1540 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe"C:\Users\Admin\AppData\Local\Temp\44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C551.tmp\C552.bat C:\Users\Admin\AppData\Local\Temp\44043135cc4c60682e3e45324e02713a675dc0d2894bc677407548e23b27881d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir /B /AD C:\Users3⤵PID:1028
-
-