ae90d22f9ce84c653c4f89222ca85ac819c11a93ca3a720f4968666b8d14d488

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
31/03/2022, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c83c2fac1fda57a7bccf27738cb14c6.exe
Size 231KB
Sample220331-l58bcaabf7
SHA256 ae90d22f9ce84c653c4f89222ca85ac819c11a93ca3a720f4968666b8d14d488
MD5 7c83c2fac1fda57a7bccf27738cb14c6
SHA1 d4880b6316cce56bda61040d11c51f242ec215f5
SHA512 7c94d62faf55f97b27fab34b18c362af2f805a133b11635dc836bb226526372e089ef916607016f34e9a0f506898f133aab16015d451f73e4dd66b233ca7e068
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2028	aytayrxctk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2028	1380	7c83c2fac1fda57a7bccf27738cb14c6.exe	79
PID 1380 wrote to memory of 2028	1380	7c83c2fac1fda57a7bccf27738cb14c6.exe	79
PID 1380 wrote to memory of 2028	1380	7c83c2fac1fda57a7bccf27738cb14c6.exe	79
PID 2028 wrote to memory of 2412	2028	aytayrxctk.exe	80
PID 2028 wrote to memory of 2412	2028	aytayrxctk.exe	80
PID 2028 wrote to memory of 2412	2028	aytayrxctk.exe	80

C:\Users\Admin\AppData\Local\Temp\7c83c2fac1fda57a7bccf27738cb14c6.exe
"C:\Users\Admin\AppData\Local\Temp\7c83c2fac1fda57a7bccf27738cb14c6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
  C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe C:\Users\Admin\AppData\Local\Temp\tmjzady
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
    C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe C:\Users\Admin\AppData\Local\Temp\tmjzady
    3⤵
    PID:2412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytayrxctk.exe

Path C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
Size 4KB
SHA256 e58dd74a32b307412c66fbe772048236e07cfba79b1e57caeb12d57f42e2dafb
MD5 184eba7a93f6ea1055da0e071b07e6cb
SHA1 fd481f0775cf788736cf5ae7389b18a1574924b7
SHA512 7ef02c99c9439832c021207e69683ebdda83b3a60cadad33e5582dd0ba0f65e97b1304db5a72922d2880ec242de731ae932652efd7828f3e81ee055d59f9da36
MD5 SHA1 SHA512

Submit Download

aytayrxctk.exe

Path C:\Users\Admin\AppData\Local\Temp\aytayrxctk.exe
Size 4KB
SHA256 e58dd74a32b307412c66fbe772048236e07cfba79b1e57caeb12d57f42e2dafb
MD5 184eba7a93f6ea1055da0e071b07e6cb
SHA1 fd481f0775cf788736cf5ae7389b18a1574924b7
SHA512 7ef02c99c9439832c021207e69683ebdda83b3a60cadad33e5582dd0ba0f65e97b1304db5a72922d2880ec242de731ae932652efd7828f3e81ee055d59f9da36
MD5 SHA1 SHA512

Submit Download

tmjzady

Path C:\Users\Admin\AppData\Local\Temp\tmjzady
Size 4KB
SHA256 32456aa376176e00d5ecc0d4466538dcaa255db1ae2009df61db869c21c79e0b
MD5 a2ec54382906856e2ebac91d212437a0
SHA1 2b892af9b7b6971e690af5305f8e530fa9b719a7
SHA512 0df55b389ba41b953936479d8244e055535d0f288d648ef3521aedea2801757b55468350d4cb2f408417dfefaf81c244cf29d891f3fbcfd0991ce564f128b923
MD5 SHA1 SHA512

Submit Download

x6tmn3wfpq08dqaz

Path C:\Users\Admin\AppData\Local\Temp\x6tmn3wfpq08dqaz
Size 211KB
SHA256 2f6337f26e1239398c6fc6ece9b4b02301e04a91ca0586bdc561d89c94b66d3a
MD5 7c5163e74bb8e436a9f021db334b94d8
SHA1 3c095050aeccd43bbb8789fa324eb26986bf928b
SHA512 bbe1ce5e8675bf46d5ee4e0d0a5c2c43f89eff0673cda956d3cac28f2ddc9cb811f1383cc1be2b3d3308b3cf7e02a49581a057dd884ea2ff8ad0ab614b27ba1d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads