56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe
Size

72KB
MD5

076faa37b02d8b4c4fa25f3775bd0e2a
SHA1

e96ae68ea374a6cecc3c95393f7c632829e9f3b1
SHA256

56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a
SHA512

f8ab809424b50c0375b05e0dc2bbc87ef5002d0d737f1934fef8a8cea65452b205210b7abafa3ada2f8188d4f8da6c73207f7d5d603559f5cc99d83febf1b419
SSDEEP

768:xDkfWemN0AQn7N6c2V7RfPrkHr8fxCU3imrGf+DmjpiMH19kF4x4UwNsQd4iuL:qfWeK0tgc2VVLpffqHjpp19VxRw6QLuL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1516	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2032	56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1516	2032	56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe	28
PID 2032 wrote to memory of 1516	2032	56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe	28
PID 2032 wrote to memory of 1516	2032	56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe	28
PID 2032 wrote to memory of 1516	2032	56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe	28

C:\Users\Admin\AppData\Local\Temp\56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe
"C:\Users\Admin\AppData\Local\Temp\56fa303cb459b13d729e6dfc349a59844bce34349f2e79deb15b05e19a6d990a.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ctj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ctj..bat

Filesize
274B

MD5
bd6bd99c648933802c1ebb359e2f4058

SHA1
369daf75c562d8a83d4e4e86e4aebc703b589a89

SHA256
7b9f1f67023f8ea05795519dcfe0cfe4e5833ed494f30815cbe84d6c42277301

SHA512
9ea3e624e98cb33761479041cb7a602c869ab3eca9f520d5d1ea99fd8042657cd9fb27748c1bd4bbdf30b6511eec04e1f2a9d263c21e5fff5d6ab3285a447900

Download Submit
memory/2032-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2032-56-0x00000000003C0000-0x00000000003D1000-memory.dmp

Filesize
68KB

Download
memory/2032-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2032-59-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download