2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce

Analysis

max time kernel
35s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:46

Target

2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe
Size

113KB
MD5

c6ecd0525cbba00ceb699766c40b58fd
SHA1

0c64822f2925ab250c60076a2a6f61f449e7d75d
SHA256

2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce
SHA512

83a1304b385e0ef4fa7d62b0a7f1590bc733e4a2129de8ecb1bcaca6984a4ae1ae5034fb1467503693b36ebc002707e15b720f55b5da0cb04f9418a5f9a98a01
SSDEEP

3072:8emcyqFcEJrRL5JbfHmTy6ol2M5bh85VN+umgLFIq:8i1Fz7mMkc18PNIgJ

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1656 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1656	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe

description	pid	process	target process
PID 1228 wrote to memory of 1656	1228	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe	cmd.exe
PID 1228 wrote to memory of 1656	1228	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe	cmd.exe
PID 1228 wrote to memory of 1656	1228	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe	cmd.exe
PID 1228 wrote to memory of 1656	1228	2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe
"C:\Users\Admin\AppData\Local\Temp\2dcd21bd710a9cb0b19d83e9355ca867e40e7407fecd7b6e4b04b273d9bfd4ce.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Plp..bat" > nul 2> nul
2⤵
- Deletes itself
PID:1656

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Plp..bat

Filesize
274B

MD5
1ad27a29578d1b130f79651a6bcdcbc8

SHA1
1f0d3c01f7ccf1f7128d83818e2309664f092381

SHA256
329cf9fcb6134c40bd3390936a546d78ada7fb2109972cd3dec0ee9b4fcd433b

SHA512
486db0246880cf7c575352d9851b39a3eecc046094ab0fede70f033052cb3f82458c513fea9e7034fb7c9fbf63b0419d3dccac5cdf2d7b4c894d7fd574428076

Download Submit
memory/1228-54-0x0000000075561000-0x0000000075563000-memory.dmp

Filesize
8KB

Download
memory/1228-55-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download
memory/1228-56-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download
memory/1228-58-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download
memory/1656-57-0x0000000000000000-mapping.dmp

Download