da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2

Analysis

max time kernel
199s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:17

Target

da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe
Size

2.4MB
MD5

b526e3f6c71759955564a1df0196ed4e
SHA1

e754514fe13c7ffe7af2e662a6b852e8748a4388
SHA256

da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2
SHA512

164687a922185f9844d57d53bed9f4b1080bd93dd07dbc05f1fb48504ed3c60d40cc1e896aeec2b4db19223a364b0999560e13eec16047124d2c01dc4e892915
SSDEEP

49152:p5/diQU/Yy/PTBBkMXQshQfIMcrxTOTPTe0rt0FPnCKakOF0ueb6tp/WjTk:p5Ffy/VBkSQshQfWr0TPTneZ6kOF/kQD

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe

description	pid	process	target process
PID 524 wrote to memory of 692	524	da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe	WScript.exe
PID 524 wrote to memory of 692	524	da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe	WScript.exe
PID 524 wrote to memory of 692	524	da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe	WScript.exe
PID 524 wrote to memory of 692	524	da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe
"C:\Users\Admin\AppData\Local\Temp\da558228b47aa3d4dce53474e84fa5d6340cb3af1eee5d279e64685458f06ff2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CmpuInfo.vbs"
2⤵
PID:692

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\CmpuInfo.vbs

Filesize
8KB

MD5
a8df7437cd973f1abefb329606bd7428

SHA1
7e1ede077df6a3835fab78a51a16c25edc881f55

SHA256
ceece00ec2eb77ebae864bd0750fcee4c1d60f68b189e710468210f9303c4ff7

SHA512
18dc49c07350da620784a95d61c39003eb0024ba6d7071f97248a25c112215533b1e2c8acfe23d10760df52f721e36b28fcbf8c1fe1346d650175174e93ef249

Download Submit
memory/524-54-0x0000000075151000-0x0000000075153000-memory.dmp

Filesize
8KB

Download
memory/692-55-0x0000000000000000-mapping.dmp

Download