9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 12:04

Target

9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe
Size

53KB
MD5

685ffa035756842204bc39a835b6c279
SHA1

22bf857038dd4c23f2c54ec3a435427e1f8e6ac2
SHA256

9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb
SHA512

ea54c356b47356e422d2a0e3b2985bb4725e2dbd2826746ff7cca8742490a2594cbf8631de5b97ff30a671e1a051a431f156a351a1d3f7399fb725066c82b3b8
SSDEEP

768:uJChTypVTFylNCQKowZS4E6SynTruH712N3b4wFBOV1mJt6oRZPJW2q5Q/2wRo:uAhTyTTFQNC13U4rtnDb4tmJ8AJq4e

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1256	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	28
PID 832 wrote to memory of 1256	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	28
PID 832 wrote to memory of 1256	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	28
PID 832 wrote to memory of 1256	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	28
PID 832 wrote to memory of 1256	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	28
PID 832 wrote to memory of 1256	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	28
PID 832 wrote to memory of 1256	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	28
PID 832 wrote to memory of 1132	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	29
PID 832 wrote to memory of 1132	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	29
PID 832 wrote to memory of 1132	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	29
PID 832 wrote to memory of 1132	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	29
PID 832 wrote to memory of 1132	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	29
PID 832 wrote to memory of 1132	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	29
PID 832 wrote to memory of 1132	832	9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe	29

C:\Users\Admin\AppData\Local\Temp\9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe
"C:\Users\Admin\AppData\Local\Temp\9f8948184fda506496cbc5a68372daf005021d8dcfb0e06edcc4cb63d66e75cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\newsetup.vbs"
  2⤵
  PID:1256
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\1.vbs"
  2⤵
  PID:1132

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\newsetup.vbs

Filesize
651B

MD5
4736e7158c27f244482f5a614b9dbdae

SHA1
d3a0e95a81e9e3ec95cfd596b25749a0e24e27b9

SHA256
b8229bc8d6b0013858fb9599cb510afa4566a439164b2c7444c449540a124acc

SHA512
cebf895dd3ec3822c42b78bac49c685b063cb5afcbcfb3850b073cb118d086c5fa75ec50b6e73d90e14f2c6b595752ad87910b8cf27378424d72a9ea309bf824

Download Submit
memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download