bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
08/07/2022, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
Size

816KB
MD5

62fd0aecb02f01f3a59131ba5ae8d38a
SHA1

2c89f903ad958316ed22706c740cde7ee759247f
SHA256

bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29
SHA512

84ef0834069a71dc1e4b73c2a927a7357dc066ff72ef479166695d45ee631155b785c1009248b2fbb8452945f8db83f4e89e5cbbc4f974d2d7ac05f8f68e2dba

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
800	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
800	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
800	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1712	800	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe	29
PID 800 wrote to memory of 1712	800	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe	29
PID 800 wrote to memory of 1712	800	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe	29
PID 800 wrote to memory of 1712	800	bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe	29

C:\Users\Admin\AppData\Local\Temp\bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe
"C:\Users\Admin\AppData\Local\Temp\bdecdba010952f854106cced016ee000bfa09dd499d66fbc43acd585c9348c29.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\
  2⤵
  PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-56-0x00000000765F1000-0x00000000765F3000-memory.dmp

Filesize
8KB

Download