8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4

Analysis

max time kernel
45s
max time network
54s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 21:14

Target

8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe
Size

265KB
MD5

412b36ba520dc7c15175aabd6fc82410
SHA1

c34d38b123efd417a74d3a8f069c24d266ae1e8c
SHA256

8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4
SHA512

06899875f934c21d945ab98727446add769ff46e07359561690f2ae02a194f6b7ae5c09dddcd88c176a5d60b2083b27ec8be0bb7ccc1cede57e6560fc1c3cd2c
SSDEEP

3072:a9eSguXvy6iIhA+C9kUu9Bc+mSqdBQSvs1C8/ehoraNUXv/uLWC7:YXvy6iIhAY3c/Nvs1C8/ehoraNUXeqe

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1800	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 1800	1576	8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe	30
PID 1576 wrote to memory of 1800	1576	8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe	30
PID 1576 wrote to memory of 1800	1576	8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe	30
PID 1576 wrote to memory of 1800	1576	8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe	30

C:\Users\Admin\AppData\Local\Temp\8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe
"C:\Users\Admin\AppData\Local\Temp\8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\16299.bat" "C:\Users\Admin\AppData\Local\Temp\8e50c8687dc7d9ed57e0c775e61ef0a195a3b0e27318c42f697ce21cb43250e4.exe""
  2⤵
  - Deletes itself
  PID:1800

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\16299.bat

Filesize
205B

MD5
af942e21a17f04903c52cb28a9b89542

SHA1
ebcfe47bad384564346db4141d26e3e68f9f984f

SHA256
c62a90b84dac61f74122f6eaa01665155a18b28a68b799a963f8a877194f922d

SHA512
790decec1485e8fc42c3ee09a3e871ee95fdf2bf2e5f15556de0a5b5db2106114d79206acf2dcf3e7c0dbe9df7b1298e0b3f7247a34d9d3bd9f296cc9b61211a

Download Submit
memory/1576-54-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download