0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34

Analysis

max time kernel
22s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34.exe
Size

90KB
MD5

7d0dfe42d8df2e5130043d4d5be48778
SHA1

4273ccd6bab7da8c14b83e638c4c76c95cbe7af6
SHA256

0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34
SHA512

59bd5177eb50ee4898dd20798345d512ab8fb74bcc238b132d3c27c44c021bec0e682f58e026cf820c11baf3d47974f22d6eb7c865020eafabedd3ae73278412
SSDEEP

1536:JerX86+/2o8HNRWkoj/DAJzFXavPhVUbPWBGFarEBhFI+L:IrXr+/2o8XZoTDAJgPYrQGfBhFIq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
848	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 848	1352	0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34.exe	27
PID 1352 wrote to memory of 848	1352	0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34.exe	27
PID 1352 wrote to memory of 848	1352	0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34.exe	27
PID 1352 wrote to memory of 848	1352	0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34.exe	27

C:\Users\Admin\AppData\Local\Temp\0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34.exe
"C:\Users\Admin\AppData\Local\Temp\0c538aa443a5ff2977304303d1e1166723733fdd63cfc35da0ed53bd0c4b1e34.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Irz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Irz..bat

Filesize
274B

MD5
da931a4e5cdfc035fd968419daa0940d

SHA1
59dfa865d3387cfe563ddaef4b3f135f2578e9b7

SHA256
e3a29dbaad79b416b6085e37e9ab1d2d87642ae441e5171d5032bb37593990e0

SHA512
c3b77b7743187012b0cda618ab1d0357d92604375ea5728c1efe917cf453c0a485d99429a7aeb9e77c3ca89bc5519dcc677e90a9957aa19cb9132ee42e65531f

Download Submit
memory/1352-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1352-55-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1352-56-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1352-58-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download