2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa

Analysis

max time kernel
16s
max time network
51s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe
Size

72KB
MD5

a728aee2ade481a30f65e19580715cf1
SHA1

a4f476c778dae9d0b474bf1a5e687774ee937ae4
SHA256

2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa
SHA512

8dcff54c5ba581c06b08bae9a3b3faa86e407ee8e3f98844015f6df307ea9ddab7821b1ca3530ef4e9c3b6d21befa655be562534b7f94bcc14ce1ac602c69a1d
SSDEEP

768:xDkfWemN0AQn7N6c2V7RfPrkHr8fxCU3imrGf+DmjpiMH19kF4x4UwNsQd4iSL:qfWeK0tgc2VVLpffqHjpp19VxRw6QLSL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1460	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
884	2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1460	884	2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe	28
PID 884 wrote to memory of 1460	884	2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe	28
PID 884 wrote to memory of 1460	884	2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe	28
PID 884 wrote to memory of 1460	884	2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe	28

C:\Users\Admin\AppData\Local\Temp\2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe
"C:\Users\Admin\AppData\Local\Temp\2b2974f841e142cfc404715dc91d9abb5ca5fdad16841bc5434eacc325d0e1fa.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Axz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Axz..bat

Filesize
274B

MD5
0e8f9aa11221e5ce82acbb41a39557c4

SHA1
0b494c6475f124d7ffc409233246227d92d89eed

SHA256
9045747fc30f434760be74d0ff5a68e2a1fe5dc709a62f8a6f95c3a9d20ec518

SHA512
8c0ea8678e8f43e28a224710f0a159bbaa1b791ee8249a3b9c940ba92ce3edc6453e8510a803aa4666fcdc141be644f350bb633892b0b3ef420e45f15785aaee

Download Submit
memory/884-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/884-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/884-56-0x0000000000220000-0x0000000000231000-memory.dmp

Filesize
68KB

Download
memory/884-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/884-59-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download