655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3

Analysis

max time kernel
36s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3.exe
Size

661KB
MD5

0e72f667660cc69d546fdfdd4efe26fc
SHA1

25bbacdb383fa4347ae8ebf7963cd29b504e5c43
SHA256

655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3
SHA512

4e8c7d6f51d55c3eabce9828d96225257f42aad33be44ba33aaa121a543597961ce2be4807079e19e76ba151f8857ee3bbc86a8e724a74b7bb51603c559f6183
SSDEEP

12288:T6SKqT31T6WpJY6V765jKqostkm3ObVn28bZxiqdMauFIm:mxqT31T6WE6I5jKqosOm+bVn28bZ4qde

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
884	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 884	1392	655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3.exe	28
PID 1392 wrote to memory of 884	1392	655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3.exe	28
PID 1392 wrote to memory of 884	1392	655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3.exe	28
PID 1392 wrote to memory of 884	1392	655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3.exe	28

C:\Users\Admin\AppData\Local\Temp\655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3.exe
"C:\Users\Admin\AppData\Local\Temp\655bf5396e958106c382e047c6c28d417ab0a7c1f5c6138ab1b0076780b536c3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\s.cmd
  2⤵
  - Deletes itself
  PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s.cmd

Filesize
285B

MD5
2f8c097498c8c6ecaad2c4514e58fdc0

SHA1
40c0fe45cd109fe9763f71a3f89039b622373181

SHA256
5b6593b0ef6abdced3a499a3f1a2fb4b5a9b68988ffb10cfb6749d884f953ba3

SHA512
005827e512e985f8d229c197a4f37a69253bee209de5babd3beb52052d9a276c1001291fa279eaf9bf0d5625a61325a43bea1e4ea17c7a0c1dcc29616520d199

Download Submit
memory/1392-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download