d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54

Analysis

max time kernel
38s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe
Size

164KB
MD5

18394e4a1e0c8b51e45ef5bf4640f185
SHA1

69e9f38f8fc427b75a7a6a39bddb6d6dbd575ba2
SHA256

d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54
SHA512

f24cb42c84e2bf1263a55e7863efbdb5f3775a484a6fc0a278f7605a37ebc8e4ea8712c08144884f5f3ee41ee117caf7d48c799cdf45594e53772301d6ac5768
SSDEEP

1536:A5HJf9MY1kGhMMdltuvJP5+FrZb2VGC/2JN:A57MY1BiMdnuvn+F2/2T

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1520	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1520	1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	28
PID 1964 wrote to memory of 1520	1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	28
PID 1964 wrote to memory of 1520	1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	28
PID 1964 wrote to memory of 1520	1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	28
PID 1964 wrote to memory of 1520	1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	28
PID 1964 wrote to memory of 1520	1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	28
PID 1964 wrote to memory of 1520	1964	d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe	28

C:\Users\Admin\AppData\Local\Temp\d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe
"C:\Users\Admin\AppData\Local\Temp\d2649b2b22210aa10de69619bd6175cac89c9496b1bbdb5ba0cabe5e8e85ea54.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Kjv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Kjv..bat

Filesize
274B

MD5
4663d034d25a7bea10a58143b4748af5

SHA1
ef9040fc08e472010997368f6b96f44bb4df4772

SHA256
74b6201ca88dacea2a76931d0c3f1e4fef69c2c0d8e0c4fa1a2176cd30d38ddf

SHA512
af26f579c40dcc7c7fc7a937f73e274e056417feafbc0888fc198f6b2cd8b13a2bc91788f3784ce0910716b6789ef96c582aaa87c2dc65cdd1ba87c9a42ba0cc

Download Submit
memory/1964-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1964-55-0x0000000000300000-0x0000000000322000-memory.dmp

Filesize
136KB

Download
memory/1964-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1964-58-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download