c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe
Size

180KB
MD5

a59bd1053163788dd2fe68ece803c44c
SHA1

006eaec2c2bcfaedf82c81c7044ace35665e99a5
SHA256

c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304
SHA512

7fdd775617d5ac9c7f1d4ee0e2291bc7a3d019769bbc385517910979fe23cd4200ec92359d924ece0b56c8de05e3978b76ca51bcb1f8919f1f9250492c9df813
SSDEEP

3072:ZKZWw/BKwd/yFjhx9aL41nnl/1/dvZJ/lMsyGzKF:ZyWw/swUFM81z/ZX9

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1672	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1672	1348	c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe	27
PID 1348 wrote to memory of 1672	1348	c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe	27
PID 1348 wrote to memory of 1672	1348	c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe	27
PID 1348 wrote to memory of 1672	1348	c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe	27
PID 1348 wrote to memory of 1672	1348	c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe	27
PID 1348 wrote to memory of 1672	1348	c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe	27
PID 1348 wrote to memory of 1672	1348	c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe	27

C:\Users\Admin\AppData\Local\Temp\c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe
"C:\Users\Admin\AppData\Local\Temp\c63f7cd0290d335c10e311e24bb01b7e4a70d135120adfceae006d5df55b0304.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Axv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Axv..bat

Filesize
274B

MD5
9aa3b56a35ca4d94419b2b6e3bf34494

SHA1
e03124aa2cea00b9c921a90edb2fb61348b54208

SHA256
7f3a1eac06587ca7a902cc484d4c990e9928790bc5899004006f89139246ca02

SHA512
8784d4abe612e86cf962e36d5dc063f09f37e5a6f323033d75c8700e63ce376e76b958719366c2d4a79e5c2fb57a53d001d32684eaf81fca32f1b8d540398d16

Download Submit
memory/1348-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1348-55-0x0000000000230000-0x0000000000262000-memory.dmp

Filesize
200KB

Download
memory/1348-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1348-58-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download
memory/1348-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download