3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 14:31

Target

3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe
Size

126KB
MD5

fda58216778f1acd2e1dec0896813670
SHA1

7ae3d2d9ce558b816c79f1d1dd4cc7a1fe2fbb59
SHA256

3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61
SHA512

4ea2c705fc5c9ae3684fb1140e0ac1d9e85d2c7bd9a9c15cd6aa5da23d5a2cea81558f81061cda1c94312a4c1a029f682e1bb664166ce38661a4774417101a2e
SSDEEP

1536:13L71KeIPGaNJwPDoDMhFaddOyaVqEUG/eVReZWhn0ranFw1JqtFuWScsY9MGMwS:13hIuErDVaVNkDEmFwit3lTS

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2044 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2044	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe

description	pid	process	target process
PID 1784 wrote to memory of 2044	1784	3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe	cmd.exe
PID 1784 wrote to memory of 2044	1784	3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe	cmd.exe
PID 1784 wrote to memory of 2044	1784	3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe	cmd.exe
PID 1784 wrote to memory of 2044	1784	3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe
"C:\Users\Admin\AppData\Local\Temp\3f96f178697b6b7dd6b9e160f1d0bf783daa5c35ab2e64e815ae6a11f1b13d61.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Efz..bat" > nul 2> nul
2⤵
- Deletes itself
PID:2044

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Efz..bat

Filesize
274B

MD5
acb3c4112d65d48330cd862e00d683e8

SHA1
167c6b50617fccd91df1adf55b679434ecc875e2

SHA256
3eba9a096a261ff9bb3d7e53855363accb0469b4d6a71414a8f73160f21cd76d

SHA512
5e253ce63fac0a054ceb029d255116031d3513697fd0cf432bd9a3c661d042b05923176787b6f1569fe8bf9d0e68acba1b711e8209fcaf9e7d78a20dd68d99f6

Download Submit
memory/1784-54-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/1784-55-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1784-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1784-57-0x0000000000230000-0x000000000025D000-memory.dmp

Filesize
180KB

Download
memory/2044-58-0x0000000000000000-mapping.dmp

Download