5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe
Size

177KB
MD5

3b8c8f1085a79b00ddc946df241e50db
SHA1

d072e577aaf8e906578827f76eaceeb7898aebb1
SHA256

5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d
SHA512

a79654f764ddc37b17a860e80426f2696c06da5d39aebeb32ac8b21e34a27d2d831a933b3428b4ad23730016ecd4a85051994a5046a4083e57fa71de01ae7205
SSDEEP

3072:8onLoLYT67BJjrPb468PRs6VAqFa6Z/jZir5g2N8yGDp+mSX:PnLo8W7PPb4pdVAAjI+t

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
840	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 840	1080	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	28
PID 1080 wrote to memory of 840	1080	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	28
PID 1080 wrote to memory of 840	1080	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	28
PID 1080 wrote to memory of 840	1080	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	28
PID 1080 wrote to memory of 840	1080	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	28
PID 1080 wrote to memory of 840	1080	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	28
PID 1080 wrote to memory of 840	1080	5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe	28

C:\Users\Admin\AppData\Local\Temp\5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe
"C:\Users\Admin\AppData\Local\Temp\5aa3dc2147d6c35ff22b56fa74dd97089a74151e198b5c71200849be2d64378d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wjz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wjz..bat

Filesize
274B

MD5
b60694427d0f2f6f2c279715d59979b1

SHA1
d8e2c32e94023e53f1444a60a22284f88a2b6e37

SHA256
17b49a992b55c35863e8c1d9d0dc6e40be5df0333702b5fbf09bb34cd5d55535

SHA512
2e3e49da477757dc0f9922ff94d4ec08b221e2489e0930c7e8a6185ff871a8d33949b2399d7669d25a515135983608bba24f5996b07a28affc7e7741ed2ae6a1

Download Submit
memory/840-57-0x0000000000000000-mapping.dmp

Download
memory/1080-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1080-55-0x00000000003B0000-0x00000000003E2000-memory.dmp

Filesize
200KB

Download
memory/1080-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1080-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1080-58-0x00000000003B0000-0x00000000003BD000-memory.dmp

Filesize
52KB

Download