68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9

Analysis

max time kernel
40s
max time network
52s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 07:43

Target

68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe
Size

111KB
MD5

412fbcfe1c6df5c73e3c4480f71ec3b6
SHA1

d2d5c85814f7355685200e63415f38600f4c5882
SHA256

68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9
SHA512

9d2b057b9b939c964870f02ebfbac7d06fe8c0fa5af781b71e18ae6d2d51f6b461fdf8ee4b803ee4a8289313ba244913fc15d7146a0f67830b62950f6d3ba66e
SSDEEP

3072:Yvz05zKu6jOKuNKEuWKDhm5mlXwWRfemB3GikaVrrQ1IPnHFIb:zyhm5m9RoiXVr01IP0

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1376	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1376	2032	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe	27
PID 2032 wrote to memory of 1376	2032	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe	27
PID 2032 wrote to memory of 1376	2032	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe	27
PID 2032 wrote to memory of 1376	2032	68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe	27

C:\Users\Admin\AppData\Local\Temp\68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe
"C:\Users\Admin\AppData\Local\Temp\68122885020b6ec1fb6a642802f8b161300ee3d7ab0eda5e5e4fbb36a5d71be9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Glz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1376

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Glz..bat

Filesize
274B

MD5
139609a78f35802ee2228a8c58231833

SHA1
05351f014de3d28bd74c16efd5eb3cc9ba1a5e41

SHA256
6d6dc176a5226e7f54004fb551a7df2ef9ef31e1bc543a451692f9bd450389b9

SHA512
124d98e57a9a463e0d5ea16dafeaf1a6ee9ef20e0f4b8a13630211d86518bbbf615d57454700175c3fd34fff6176efe02d35ef791d3c7f4e19bd1eb021127f2e

Download Submit
memory/2032-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2032-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2032-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download