dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10

Analysis

max time kernel
47s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe
Size

87KB
MD5

2158fc840ba25de5147bcb59ea64ac27
SHA1

bec3c16910241f3252e5da5e5af997616df4d824
SHA256

dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10
SHA512

41d1d7ae0cffaa32a3a043eab7d5b318254a6fddb77699242d9cf083a3fc03c1bdf1449c4e3814aba72f2b28473b95b026282d822c3a45e7f0186c84b7885f5b
SSDEEP

1536:2IATtl142gS77xDx2MJigYS54bN9rCKRZeMwduH18U2V94RO:Ry142577P2VlDb3uezwduHmrV7

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
2020	ipconfig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1060	dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 2020	1060	dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe	27
PID 1060 wrote to memory of 2020	1060	dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe	27
PID 1060 wrote to memory of 2020	1060	dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe	27
PID 1060 wrote to memory of 2020	1060	dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe	27

C:\Users\Admin\AppData\Local\Temp\dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe
"C:\Users\Admin\AppData\Local\Temp\dcddbcabf558f496d71ce15c32262879e6cb026621c8181f64877d9bbb709a10.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\ipconfig.exe
  "C:\Windows\system32\ipconfig.exe" /flushdns
  2⤵
  - Gathers network information
  PID:2020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-54-0x0000000000401000-0x0000000000403000-memory.dmp

Filesize
8KB

Download
memory/1060-57-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download