ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486

Analysis

max time kernel
150s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 06:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe
Size

1.4MB
MD5

17f4c30d9a539768a234cf175ec55601
SHA1

157ff806977efca870fdbbd5647ac1580d0d90cc
SHA256

ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486
SHA512

9076c9e1b35cb0768a43885a1c27ac02fb30624bbffb8678a6a2f98d8a3de91163f97ea24f59dc9b6127285c2031e13889c7c8dc05a4b17d8faad518a5e42b84
SSDEEP

24576:3qi2Dv7gosohG20JaB7SNWa6StffOSqICV+GKTMiaIH1qMQheH:lCb9SL60ql+3H8hg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
936	search.cmd

Deletes itself 1 IoCs

pid	Process
1276	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe

Loads dropped DLL 2 IoCs

pid	Process
1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe
1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
936	search.cmd

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 936	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	27
PID 1600 wrote to memory of 936	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	27
PID 1600 wrote to memory of 936	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	27
PID 1600 wrote to memory of 936	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	27
PID 1600 wrote to memory of 1276	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	28
PID 1600 wrote to memory of 1276	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	28
PID 1600 wrote to memory of 1276	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	28
PID 1600 wrote to memory of 1276	1600	ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe	28

C:\Users\Admin\AppData\Local\Temp\ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe
"C:\Users\Admin\AppData\Local\Temp\ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del c:\users\admin\appdata\local\temp\AC2745~1.EXE >> NUL
  2⤵
  - Deletes itself
  PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
17f4c30d9a539768a234cf175ec55601

SHA1
157ff806977efca870fdbbd5647ac1580d0d90cc

SHA256
ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486

SHA512
9076c9e1b35cb0768a43885a1c27ac02fb30624bbffb8678a6a2f98d8a3de91163f97ea24f59dc9b6127285c2031e13889c7c8dc05a4b17d8faad518a5e42b84

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
17f4c30d9a539768a234cf175ec55601

SHA1
157ff806977efca870fdbbd5647ac1580d0d90cc

SHA256
ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486

SHA512
9076c9e1b35cb0768a43885a1c27ac02fb30624bbffb8678a6a2f98d8a3de91163f97ea24f59dc9b6127285c2031e13889c7c8dc05a4b17d8faad518a5e42b84

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\search.cmd

Filesize
1.4MB

MD5
17f4c30d9a539768a234cf175ec55601

SHA1
157ff806977efca870fdbbd5647ac1580d0d90cc

SHA256
ac2745651a4dbdabb4f6febeb97456f66551b55e489efd3ffa8769abda33c486

SHA512
9076c9e1b35cb0768a43885a1c27ac02fb30624bbffb8678a6a2f98d8a3de91163f97ea24f59dc9b6127285c2031e13889c7c8dc05a4b17d8faad518a5e42b84

Download Submit
memory/936-63-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/936-64-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1600-54-0x0000000076461000-0x0000000076463000-memory.dmp

Filesize
8KB

Download
memory/1600-55-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/1600-62-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download