7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a

Analysis

max time kernel
57s
max time network
59s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 15:29

Target

7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe
Size

77KB
MD5

6d604ea44e0731e836b5236adf393cbf
SHA1

3d4808f68950b87fee070e5d29da99fe96687d46
SHA256

7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a
SHA512

dbe8c91b0baa37d04addff7bafdcc0485d0cc6650270123742149708a431b65b066e7db06072db45271f67eeb961899e1157f22b036287339b70acacaebae9fb
SSDEEP

1536:AiQgzHtbbeQi4C9bnWe7z9EQ3G2e7JqSbk4p:lQgzHtCNhWSGXVqz4p

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

468 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
468	cmd.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe

description	pid	process	target process
PID 1308 wrote to memory of 468	1308	7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe	cmd.exe
PID 1308 wrote to memory of 468	1308	7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe	cmd.exe
PID 1308 wrote to memory of 468	1308	7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe	cmd.exe
PID 1308 wrote to memory of 468	1308	7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe	cmd.exe
PID 1308 wrote to memory of 468	1308	7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe	cmd.exe
PID 1308 wrote to memory of 468	1308	7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe	cmd.exe
PID 1308 wrote to memory of 468	1308	7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe
"C:\Users\Admin\AppData\Local\Temp\7529077f0b1836591f0d892ed371431b4d6237fa7c64b39bbe24e1be2159179a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ctp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:468

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Ctp..bat

Filesize
274B

MD5
58cdd5b75ba7af465ceced135720c3fe

SHA1
e041236213ef2a115d0ac45488ff4d1cd3b3b797

SHA256
3064a43cbae6ff72f254ebe3fe0a49ed3c3567b3d35919f22901fad5e4b2f7c8

SHA512
e50ded17fa5e62d33f99ed5bfa386bec2e76ce268f230024a3cb707093854042c4979b8ffc747eb7427e8ad6908d4d19bf60d958cf9d76ad2dc8cc28031ecc1e

Download Submit
memory/468-58-0x0000000000000000-mapping.dmp

Download
memory/1308-54-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1308-55-0x00000000002F0000-0x000000000030C000-memory.dmp

Filesize
112KB

Download
memory/1308-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1308-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1308-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download