d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 08:42

Target

d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd.exe
Size

167KB
MD5

ab68cdcbf5bbf4a4d2b71493305f0fa9
SHA1

eabfa6123dc745d142b23d51638e002bdb9f4b51
SHA256

d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd
SHA512

0b0d22b160a4be546a0d96d402296a11b8bda2baf05cd3f882372f31acee22c0d775e30be39632ec4aafe2485917cde54e3fedfcc2ff07188c6ce68dc27a7ad8
SSDEEP

3072:+qwnALiATU+lsg2dx062lqzQwVBQ4/54z1xsOed+4auIlSct:6HNqsg2D0Hlcx/5wx0QXuI

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1376	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1376	1844	d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd.exe	27
PID 1844 wrote to memory of 1376	1844	d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd.exe	27
PID 1844 wrote to memory of 1376	1844	d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd.exe	27
PID 1844 wrote to memory of 1376	1844	d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd.exe	27

C:\Users\Admin\AppData\Local\Temp\d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd.exe
"C:\Users\Admin\AppData\Local\Temp\d3b00b4d4f490e4c78adc45b94c07d1fa52026a2d2e717145f35459b82eeeebd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Yzv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1376

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Yzv..bat

Filesize
274B

MD5
af9063a3f27395c60be43ae7b580b410

SHA1
f6ea9c279f7c505fd95d9f721b7c2053fae94b8f

SHA256
277d21cf13296a53a18c0585860d8151bbacd342f0372fae14eb1ece5e6b7750

SHA512
da46f27dcc5e2d635d061d1813e67350f9c7d9da5e3d590030fcf9906378a55b5c5fdde8399495f474ba2b75f4d016e3f852e32e9197f65425a2bf94129bbf31

Download Submit
memory/1844-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1844-55-0x0000000000120000-0x0000000000128000-memory.dmp

Filesize
32KB

Download
memory/1844-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1844-58-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download