c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26/10/2022, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe
Size

302KB
MD5

e847fb3f4528d7c82cadbdbf7897d40d
SHA1

73d6bb3b5e110b05a25212cf2b2f80f7f7509763
SHA256

c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f
SHA512

5b1e17626fee819ce89e4604b3e6ee65f9e34cf5cc4bb0a8300d5a87af17bba4c1cf671e62eebab6ca17a554c6883cd8077aa72b4a19fed37d117541941972d0
SSDEEP

6144:9dTeqdWpOXZUFVZpcozdbr9sNcQGLoGIqsSzY6uYPqp:9d/UPdbr9sNcQGjIZS8r3p

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1892	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1892	2016	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe	26
PID 2016 wrote to memory of 1892	2016	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe	26
PID 2016 wrote to memory of 1892	2016	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe	26
PID 2016 wrote to memory of 1892	2016	c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe	26

C:\Users\Admin\AppData\Local\Temp\c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe
"C:\Users\Admin\AppData\Local\Temp\c49bf2b7c07539cca8688018d0d6ede9571b67f152d003696eb6f8e5d309761f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\delete.bat" "
  2⤵
  - Deletes itself
  PID:1892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\delete.bat

Filesize
70B

MD5
2dec7b4e8c057539a70d92871e25de01

SHA1
7ebe1784ead75478ce04a3e19b98e3199389b9fd

SHA256
2ae41c431228fdddafd31113b62891a6f219272b7e5cd95f7679a8dfd4519d36

SHA512
0da17b940d4616c2323bcf9d3bfe03707d6b841b414d50e4730dacc18221d0788a29331186c2102eb78f9166dc318efcdd68aa5dcbe1c1f5531ce5c7c76afd67

Download Submit
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download