ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98

Analysis

max time kernel
35s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe
Size

236KB
MD5

b5c7ef5240fa120961542041e4cd6aed
SHA1

c87d619c8cc69c83eaf5cf0bda9647c64d05234d
SHA256

ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98
SHA512

c179ef1f2c342b2837c1b17e0a25575fd5a697ad9e2910b5a441447a8ee74f00c0253baaa2c0d6811bf4aa6707a85a613717a9428f8a2d875da82772f21af6f4
SSDEEP

3072:axMDADKbAtG1HVx+erzAaJ/h2DWkJXefoisp+OQsehH4q4/:aipHVxtEU4/JXefop+oehHR

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1060	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1060	1928	ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe	26
PID 1928 wrote to memory of 1060	1928	ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe	26
PID 1928 wrote to memory of 1060	1928	ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe	26
PID 1928 wrote to memory of 1060	1928	ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe	26
PID 1928 wrote to memory of 1060	1928	ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe	26
PID 1928 wrote to memory of 1060	1928	ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe	26
PID 1928 wrote to memory of 1060	1928	ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe	26

C:\Users\Admin\AppData\Local\Temp\ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe
"C:\Users\Admin\AppData\Local\Temp\ca9582b6e8b37acb20c295f9e7012c4b6ad46598299084f2205630f75a6ccf98.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dgb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dgb..bat

Filesize
274B

MD5
ca5a9db6dd323fc70c37d99b57379cee

SHA1
aa31388e16bdd896e06ad914799eab63034dafeb

SHA256
e9aa44b8c9bae68081811d94d9312e600fa159871c8b596921a37c7530df3276

SHA512
c3058a5513113070cf7c36cd5a60529645134dc431b80fdb4f63bbd1330d8cf1a01d3591c285f1b0b03833f502f2b0a2de250cfa319a188c957fa4478d6bf965

Download Submit
memory/1928-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1928-55-0x0000000000230000-0x0000000000270000-memory.dmp

Filesize
256KB

Download
memory/1928-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1928-58-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download
memory/1928-59-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download