10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe
Size

110KB
MD5

1219fd92b856af801222a81847144bd1
SHA1

1c70af841e3a44a625d5b010d94a7f1691fa8a22
SHA256

10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a
SHA512

26ee83d1d545b455227781da74fa43459047b36b301bd7e9fe96cf1008279d2f3ae88ef46f227b63af73bce79b4024e42ab7cf581ad0d36fa3409d25385f54f9
SSDEEP

1536:h0LFGxfLR3JaTNjDTJIBTtL9qfEovoWODtaqPhNm1ekqan2/MI:hMGh1Ja1q3L9qfHIDbJNvV

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1316	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1316	1768	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe	27
PID 1768 wrote to memory of 1316	1768	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe	27
PID 1768 wrote to memory of 1316	1768	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe	27
PID 1768 wrote to memory of 1316	1768	10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe	27

C:\Users\Admin\AppData\Local\Temp\10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe
"C:\Users\Admin\AppData\Local\Temp\10f5c278cd9c701b8c8691af9df8cde3ddd7f64b8a0cbd3c6eb294aa8117b93a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Onb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Onb..bat

Filesize
274B

MD5
375a2a41f8e9fd540a67dd9182394f48

SHA1
f6dad3b97481676df7ca6ea34afb5dfcf949b0c8

SHA256
7d136d74e2eecebe59ce542ca64a047dadfa18acbeed9931ac0bc6b90b475244

SHA512
6343532a178b4509d0bd5851c0db4ae053447af290a506ed8a86056c6c361ac96d2ef7321cb22af82c752d4930a6482d5d5a4992209f267e3cc7336dc31a054c

Download Submit
memory/1768-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1768-55-0x00000000001B0000-0x00000000001C7000-memory.dmp

Filesize
92KB

Download
memory/1768-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1768-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download