aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8

Analysis

max time kernel
15s
max time network
52s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 19:11

Target

aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8.exe
Size

116KB
MD5

0b9470ea18ede5450d95255fb856dd17
SHA1

70a946c8b7490c28f0d338197e5cd108cbf7ec40
SHA256

aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8
SHA512

c6be4e7650cf5e0b7b7b82ef3d73441d759adf820d04bc6430543b6f6c44014309ce28de1cd282d7024fdbaecd9ef3cef8db32452f1443970af5d5e8da508e13
SSDEEP

1536:e8MFN7qNlfNe+zLipk+JOmuvBGVa/TYareDRRdauTZ8yEnm+Ad4gricMsW:Cb7q71LzLikOupGVgeDsuTZAo4lsW

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1068	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1068	2028	aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8.exe	28
PID 2028 wrote to memory of 1068	2028	aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8.exe	28
PID 2028 wrote to memory of 1068	2028	aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8.exe	28
PID 2028 wrote to memory of 1068	2028	aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8.exe	28

C:\Users\Admin\AppData\Local\Temp\aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8.exe
"C:\Users\Admin\AppData\Local\Temp\aa361c7d75b9915dc9eb617b45d5d54419562d690e85d94be75de87c590d50b8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Xkp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1068

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Xkp..bat

Filesize
274B

MD5
bc6f222cfc1e992bfaefbccfb8d23278

SHA1
37d4a1d5a7788bf1f822647e4b02f5581f067f27

SHA256
40e13edd2aed0a8c8f5eb1e17bd219f0839c9dd6d8ed15d463183a3b0eec568d

SHA512
14fe44c404da231979f23477b186d8cc4f6d965a9753f6fd0755df3482846128afa2dec3f61ecae61f86df00b9d905e064241c16f19a545422bf2d4f2b4fc536

Download Submit
memory/2028-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-56-0x00000000001A0000-0x00000000001AC000-memory.dmp

Filesize
48KB

Download
memory/2028-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download