598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 11:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe
Size

79KB
MD5

3222a71f4f35ba26252fc3bed10086a4
SHA1

83d874071e69c8d03987dcef0382544668e04f20
SHA256

598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985
SHA512

378696efa119ffd1312ebb655ae43a04fee6a4eaac9f3ecf134820620937dcf67a3a33c342ca914d50f0e244deb181a2d270fce9edc4a72f9112b9f21f3496a5
SSDEEP

1536:VKoYJ/VnGgXqkwk885iXMmX5zGpY8A24xk6p:woyVGZD8IMm6J4xk

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1936	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1936	1504	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe	26
PID 1504 wrote to memory of 1936	1504	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe	26
PID 1504 wrote to memory of 1936	1504	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe	26
PID 1504 wrote to memory of 1936	1504	598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe	26

C:\Users\Admin\AppData\Local\Temp\598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe
"C:\Users\Admin\AppData\Local\Temp\598bcd159fdaf45dda352d2f0cd92f182b033e53adea3db6f49ef29328761985.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Unf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unf..bat

Filesize
274B

MD5
0f8fa21303e737612cfbb06f8a71057c

SHA1
c6064d660391b3ad5a222343314f83666f655f3d

SHA256
ab0fa668388751644b9fc322e9ad0531cabfeaf82fad198eb845cab5f16c2f56

SHA512
79c98345c7b98c4cb4d2421e450b166f5c691cfd5bac89ee2c473736ac026f5b2e06e108f24fc8cf01d2a02869a9c919e41fcc9b13fd83b26e3df47a863a80f9

Download Submit
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1504-57-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download