34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe
Size

85KB
MD5

b85fece882b79cf34c867839ae6ef7e1
SHA1

58b85164d5bec01bda9caabf23daee7fa7be8343
SHA256

34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359
SHA512

c3c65a2a2b953f62a67b4328cbe4c37cfaa29ed6cd8818ca1382ab2092596c37a146b69179896f621f568fcd1236918b62a66185d43d295616c69235d72c087e
SSDEEP

1536:v6tLTUdt0D09m23CDj7+STN05xiSLRs4m8:StLYdt0om23M7+6GD3l

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
948	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 948	1584	34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe	26
PID 1584 wrote to memory of 948	1584	34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe	26
PID 1584 wrote to memory of 948	1584	34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe	26
PID 1584 wrote to memory of 948	1584	34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe	26
PID 1584 wrote to memory of 948	1584	34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe	26
PID 1584 wrote to memory of 948	1584	34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe	26
PID 1584 wrote to memory of 948	1584	34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe	26

C:\Users\Admin\AppData\Local\Temp\34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe
"C:\Users\Admin\AppData\Local\Temp\34d2837c61d4fc5e0dfa58b54f616c6e9f56ebaba980f386874539d25fe2b359.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ddf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ddf..bat

Filesize
274B

MD5
b5638fcf0dc28fe577b75a01763330b1

SHA1
f72233e929741df0b464b1d121c6dc592d85a6a1

SHA256
775d0dc72020fd9bbd41f7c99ea0770eea13933480934bbd2759b8e650dea302

SHA512
33a3adcb9a7ba77efe83cbe4369f7e825acd9f4b5ff3212f378a3de49196088913264810d3dc423e6cf6cc699f32c3abb7055c4760848979e27f58adc049b4a8

Download Submit
memory/1584-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1584-55-0x00000000002B0000-0x00000000002C4000-memory.dmp

Filesize
80KB

Download
memory/1584-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1584-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download