53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe
Size

189KB
MD5

0d07350ecc7bf35bbeae07c890893043
SHA1

2b9cd9e48716658faafa1bac65c434e9db3938ef
SHA256

53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59
SHA512

c3b997027d98d64f653e219ea67559db7eebdaae10b087f46f6c712eb90cc779e7e8cec0cd8809c967c8c01b08c21d878325e0cfd740bbe29756a39f900c3c44
SSDEEP

3072:gxwnmp+2vp7NR4w0SAitBjrq3MjOTGBrub+69olekjG:g2U+KZIw0Ee0OUrub+69olek

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1500	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1500	912	53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe	28
PID 912 wrote to memory of 1500	912	53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe	28
PID 912 wrote to memory of 1500	912	53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe	28
PID 912 wrote to memory of 1500	912	53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe	28
PID 912 wrote to memory of 1500	912	53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe	28
PID 912 wrote to memory of 1500	912	53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe	28
PID 912 wrote to memory of 1500	912	53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe	28

C:\Users\Admin\AppData\Local\Temp\53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe
"C:\Users\Admin\AppData\Local\Temp\53ea955883879b5589a27391ed2db03f06816369f4026d335fc7789738336e59.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pmv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Pmv..bat

Filesize
274B

MD5
2f130be8fea05fa05b097b37819234d4

SHA1
ea8306a1c5cb2bfa7570faea5ce9e1495c5613e8

SHA256
4f0e5c59bb4662a2824e05e382c34b801c28a76a6b9d367607629eb93127e014

SHA512
07c32314027b0df6054ef98be6c464da16b26b39aba9eba9f3cd09f6162d1f147de9f235942f1b3a9768151258a6a4f3993c209c84b36e409539b2cb5892490a

Download Submit
memory/912-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/912-55-0x00000000004C0000-0x00000000004ED000-memory.dmp

Filesize
180KB

Download
memory/912-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/912-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/912-59-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download