925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c

Analysis

max time kernel
4294178s
max time network
130s
platform
windows7_x64
resource
win7-20220310-en
submitted
12-03-2022 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe
Size

9.3MB
MD5

a10948c81c94dfaa2176c58e40ad8c39
SHA1

11a2eb8172e39871e5afac4e7d048667371f1aea
SHA256

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c
SHA512

bcbddde3d450856cb4324e1015f07e3c2c53dc50ee214b19911b64d5a5922a55687531bfcd93d6f7516874f6fc9fe7493dddbbc231ab55b26ea60d9b384e00cf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe

description	pid	process	target process
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe
PID 1368 wrote to memory of 1344	1368	925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe
"C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\AAEF.tmp\AB5D.bat C:\Users\Admin\AppData\Local\Temp\925b0fcaa52e56dedad8615ad9a8e5335a01b345e6ddd79aea20c216a365991c.exe"
2⤵
PID:1344

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AAEF.tmp\AB5D.bat
MD5
221a5b78e84926beac2c4bbae465eab1

SHA1
dd577cae4cced36a8a827c4f4ffeafb0a7676861

SHA256
fe783973ea583f903ff36bf9af41464356b09e40daa55e129e4fd92a89b4c50a

SHA512
1cc0e1da5b6a1c7a3d37c4361d57440fc7bcbdae416e78ffd9e51076bf13c842b90344beef6b319fc46f8eb0ccc5b05d612d3db088ba7575724ce92614975647

Download Submit
memory/1368-54-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download