fc02bea6ad10db0038b24d96fe214bff9a6b8f585c8b6226dfc332dccc49ff13 | Triage

Analysis

max time kernel
64s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 12:14

Sharing

Report Analysis Logs

General

Target

encrypt.bat
Size

950B
MD5

0124934376b3d4b7695386fa58f47ca3
SHA1

7f9dcfd22afa725e6f206cf233601a80f5e33a2b
SHA256

578d6397b036e14e6fad668b7a2ef6b0cdfe850980a6dcde6ec0cf609bc033c5
SHA512

6192ba4e38db84272c785405fcd779218380e2977672851aa3753464bc568566d6f2b32d09bbde46793b3d45f9edebf985fa8129371e764dca2a0e2d7582d644

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4484	4440	cmd.exe	85
PID 4440 wrote to memory of 4484	4440	cmd.exe	85

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\encrypt.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Windows\system32\xcopy.exe
  xcopy "C:\Users\Administrator\Desktop\*" "C:\Users\Administrator\Documents\Desktop" /e /y
  2⤵
  PID:4484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads