dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2

Analysis

max time kernel
164s
max time network
88s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe
Size

5.1MB
MD5

6fd27220c68e47aa2f7867173bbc7d8e
SHA1

88666798a4e574b2ae52d9399805a7e4c401b092
SHA256

dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2
SHA512

8850c0a9a0df4b3b42058bc139e6c133614c9cd03b569168aeb2048ae2931d44dafbccbea3f29a27c0a281dfd4e79a0b68493836b48a7c9a6297c1b65cb4fc79
SSDEEP

24576:QBi14HEntb6qqW0BtSasydx+/gWD2BND6t3LYXIH1qMQop:QB1HSwKX2zWYYH8op

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1484	search.cmd

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe

Loads dropped DLL 2 IoCs

pid	Process
1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe
1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1484	search.cmd

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1484	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	29
PID 1028 wrote to memory of 1484	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	29
PID 1028 wrote to memory of 1484	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	29
PID 1028 wrote to memory of 1484	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	29
PID 1028 wrote to memory of 1504	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	31
PID 1028 wrote to memory of 1504	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	31
PID 1028 wrote to memory of 1504	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	31
PID 1028 wrote to memory of 1504	1028	dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe	31

C:\Users\Admin\AppData\Local\Temp\dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe
"C:\Users\Admin\AppData\Local\Temp\dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del c:\users\admin\appdata\local\temp\DD8F23~1.EXE >> NUL
  2⤵
  PID:1504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
5.1MB

MD5
6fd27220c68e47aa2f7867173bbc7d8e

SHA1
88666798a4e574b2ae52d9399805a7e4c401b092

SHA256
dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2

SHA512
8850c0a9a0df4b3b42058bc139e6c133614c9cd03b569168aeb2048ae2931d44dafbccbea3f29a27c0a281dfd4e79a0b68493836b48a7c9a6297c1b65cb4fc79

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
5.1MB

MD5
6fd27220c68e47aa2f7867173bbc7d8e

SHA1
88666798a4e574b2ae52d9399805a7e4c401b092

SHA256
dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2

SHA512
8850c0a9a0df4b3b42058bc139e6c133614c9cd03b569168aeb2048ae2931d44dafbccbea3f29a27c0a281dfd4e79a0b68493836b48a7c9a6297c1b65cb4fc79

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
5.1MB

MD5
6fd27220c68e47aa2f7867173bbc7d8e

SHA1
88666798a4e574b2ae52d9399805a7e4c401b092

SHA256
dd8f23ee32d3f536b7697e784ed1b696e3806fca92290556ed41351779c700a2

SHA512
8850c0a9a0df4b3b42058bc139e6c133614c9cd03b569168aeb2048ae2931d44dafbccbea3f29a27c0a281dfd4e79a0b68493836b48a7c9a6297c1b65cb4fc79

Download Submit
memory/1028-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/1028-55-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/1028-61-0x0000000003F70000-0x000000000448C000-memory.dmp

Filesize
5.1MB

Download
memory/1028-64-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download
memory/1484-62-0x0000000000400000-0x000000000091C000-memory.dmp

Filesize
5.1MB

Download