4bb31847846180bf78033b5eb7761b874b114f6dd086862472915be761fc042a

Analysis

max time kernel
23s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
09-06-2022 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7zS8A52FD1B/62a1ea2b65292_c4804f5141.exe
Size

288KB
MD5

f902561ae91aad8b234cddf38401cad1
SHA1

cc3e9aadce50c820f147b194ba558b2abf25c16b
SHA256

6bdf30e72d6f74a83a5ce0a84202aab030db0ffd61850fe9154eceaabc282e65
SHA512

c9170b3f855f2721c3f713776b65da69ac51ddf9109fa4a2bef18174ed96cbbb7c9faab5e57f44347a85d8a6b7d8e5958a23f4e19db5209fda4ea4860f5abd30

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

828 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2044 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2044 taskkill.exe

pid	process
828	cmd.exe

pid	process
2044	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2044	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

62a1ea2b65292_c4804f5141.execmd.exe

description	pid	process	target process
PID 880 wrote to memory of 828	880	62a1ea2b65292_c4804f5141.exe	cmd.exe
PID 880 wrote to memory of 828	880	62a1ea2b65292_c4804f5141.exe	cmd.exe
PID 880 wrote to memory of 828	880	62a1ea2b65292_c4804f5141.exe	cmd.exe
PID 880 wrote to memory of 828	880	62a1ea2b65292_c4804f5141.exe	cmd.exe
PID 828 wrote to memory of 2044	828	cmd.exe	taskkill.exe
PID 828 wrote to memory of 2044	828	cmd.exe	taskkill.exe
PID 828 wrote to memory of 2044	828	cmd.exe	taskkill.exe
PID 828 wrote to memory of 2044	828	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2b65292_c4804f5141.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2b65292_c4804f5141.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "62a1ea2b65292_c4804f5141.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS8A52FD1B\62a1ea2b65292_c4804f5141.exe" & exit
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "62a1ea2b65292_c4804f5141.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2044

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-55-0x0000000000000000-mapping.dmp

Download
memory/880-54-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/880-56-0x00000000009CE000-0x00000000009F4000-memory.dmp

Filesize
152KB

Download
memory/880-57-0x00000000002C0000-0x00000000002FF000-memory.dmp

Filesize
252KB

Download
memory/880-58-0x0000000000400000-0x0000000000912000-memory.dmp

Filesize
5.1MB

Download
memory/2044-59-0x0000000000000000-mapping.dmp

Download