46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459

Analysis

max time kernel
152s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/10/2022, 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe
Size

1.4MB
MD5

82f57016eb8be59d5c298778b0638072
SHA1

1d0479b2227b94cbf05a22fc17979b122ceb5f53
SHA256

46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459
SHA512

7877d89ca3d57199c823c8b310774890716fa7f1b86663b5b72e8501bfafe1f58a3b480cb74c61bcb69a547e23e62a8428353ec0d44c0def9189f494c69c75c1
SSDEEP

24576:8i2Dv7gosohG20JaB7SNWa6StffOSqICV+GKTMiaIH1qMQheh:fCb9SL60ql+3H8hk

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
972	search.cmd

Deletes itself 1 IoCs

pid	Process
1964	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe

Loads dropped DLL 2 IoCs

pid	Process
1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe
1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
972	search.cmd

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 972	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	27
PID 1944 wrote to memory of 972	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	27
PID 1944 wrote to memory of 972	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	27
PID 1944 wrote to memory of 972	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	27
PID 1944 wrote to memory of 1964	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	28
PID 1944 wrote to memory of 1964	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	28
PID 1944 wrote to memory of 1964	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	28
PID 1944 wrote to memory of 1964	1944	46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe	28

C:\Users\Admin\AppData\Local\Temp\46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe
"C:\Users\Admin\AppData\Local\Temp\46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del c:\users\admin\appdata\local\temp\46C6B7~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
82f57016eb8be59d5c298778b0638072

SHA1
1d0479b2227b94cbf05a22fc17979b122ceb5f53

SHA256
46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459

SHA512
7877d89ca3d57199c823c8b310774890716fa7f1b86663b5b72e8501bfafe1f58a3b480cb74c61bcb69a547e23e62a8428353ec0d44c0def9189f494c69c75c1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
82f57016eb8be59d5c298778b0638072

SHA1
1d0479b2227b94cbf05a22fc17979b122ceb5f53

SHA256
46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459

SHA512
7877d89ca3d57199c823c8b310774890716fa7f1b86663b5b72e8501bfafe1f58a3b480cb74c61bcb69a547e23e62a8428353ec0d44c0def9189f494c69c75c1

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
82f57016eb8be59d5c298778b0638072

SHA1
1d0479b2227b94cbf05a22fc17979b122ceb5f53

SHA256
46c6b7874c0511eaa4e12d5eb464571b143c706bd4b06421bb0f746f467f1459

SHA512
7877d89ca3d57199c823c8b310774890716fa7f1b86663b5b72e8501bfafe1f58a3b480cb74c61bcb69a547e23e62a8428353ec0d44c0def9189f494c69c75c1

Download Submit
memory/972-61-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/1944-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1944-55-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/1944-60-0x0000000003160000-0x00000000032CB000-memory.dmp

Filesize
1.4MB

Download
memory/1944-64-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download