fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a

Analysis

max time kernel
35s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe
Size

114KB
MD5

718150b242a6a4212fb442c8778f4710
SHA1

d13aca4c7cf92989f86f51f603a963cc76298cc5
SHA256

fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a
SHA512

49037fc75b01b8101ad007943fced3c921ef922c0efebe3a3d27a77a5f8b993634d434bac2916314f8ff39278babe656ff9e31478c008a09e8eb278fe5ecfffd
SSDEEP

1536:XXSKvDz+asR2EPeJ+LZCsqBK30yYqUgb+/5qzRteuZfpAXcVIleqBzh7fsXn4eZ9:HsLPFkbSoNE7lQu7E2bFWY1AE9Tca

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1696	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 1696	1172	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe	27
PID 1172 wrote to memory of 1696	1172	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe	27
PID 1172 wrote to memory of 1696	1172	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe	27
PID 1172 wrote to memory of 1696	1172	fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe	27

C:\Users\Admin\AppData\Local\Temp\fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe
"C:\Users\Admin\AppData\Local\Temp\fe3ccd51afa977aee88cedbba8b87f41c8ff55d102b7fd7291cc6b44867a584a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Oqb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Oqb..bat

Filesize
274B

MD5
20d8d2098b7ae2655dee11711e129ec7

SHA1
22bbcb6e584c3e541ea582d1b0aa1ab7b0b5d1ee

SHA256
9679134fee910dfca4f313e5f42889094d0a3dddbccae7825595ca28fca536dc

SHA512
db6fff1a7c0dba0b5dac36ba1f7e77d26437cbeb7b529de6137b7b39133611a202c23d8982ca97682214bca887448f9f2296b287380f17b324b192dfa1e65b29

Download Submit
memory/1172-54-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1172-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1172-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download