d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266

Analysis

max time kernel
31s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266.exe
Size

99KB
MD5

9b14bb84e05ce74dd37820af9bafd0b0
SHA1

3a8c430290852f9854aa36ebb7e8692133d62a9a
SHA256

d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266
SHA512

836b03dd6e5fa5e9494ee21382d1c9787b8d3669057220b85b4c300d9b3c92ee0263aad21b7d47d25254a8b72bf5255466f6f9cb41b148032b7719e7d243709e
SSDEEP

1536:rJ90BNtzSVyAfiUFmr+m8GdFIdH2qocKRVzcMXDl+Fi6Gah1qHeeGQ:jUN0Vnmr6GLIV2rcKfcexJ6GiZev

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1656	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1656	900	d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266.exe	27
PID 900 wrote to memory of 1656	900	d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266.exe	27
PID 900 wrote to memory of 1656	900	d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266.exe	27
PID 900 wrote to memory of 1656	900	d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266.exe	27

C:\Users\Admin\AppData\Local\Temp\d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266.exe
"C:\Users\Admin\AppData\Local\Temp\d4686a6aa2c99e27e650c6f7074fedb58d8e38a61243a7d0bbfd7a3088e4a266.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:900
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Dnj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Dnj..bat

Filesize
274B

MD5
0c40794e86795e45474d8d1f37970b5f

SHA1
f90bc9cfbfea53f58a7d2631a4170bcf21a805a4

SHA256
8a94eb61ed2f7fee68f62598ddd1590d692be70d8868136639dab7a0f746ab65

SHA512
2480469461fdd0dd2d4e71f363627ff23a04614f2d497165b93dc8456f5acdcf00bfbb6a271dcc1c0cb17104d3a6c66bfc20f227c94efee8154931c738b9cecb

Download Submit
memory/900-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x00000000003C0000-0x00000000003DB000-memory.dmp

Filesize
108KB

Download
memory/900-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/900-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download