5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe
Size

162KB
MD5

02c617c920482b231b03a002541c35e7
SHA1

adc55848570bc4718e25c6a0131cd63ca2f4ba0e
SHA256

5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17
SHA512

7813858f3754172650a61e931d48e003ffa112dcb5b66e0562efd82cf566724b35eb988b1c2dba463c567e91483bc6e43d6fa14a9da1754fed5c5a9050ee2e7d
SSDEEP

3072:O/7UTpCV3eN1mEbdnkdfYTz8oDp3DAWU:O/7GNbmEByYTz/hDA

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
960	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 960	1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe	28
PID 1264 wrote to memory of 960	1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe	28
PID 1264 wrote to memory of 960	1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe	28
PID 1264 wrote to memory of 960	1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe	28
PID 1264 wrote to memory of 960	1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe	28
PID 1264 wrote to memory of 960	1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe	28
PID 1264 wrote to memory of 960	1264	5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe	28

C:\Users\Admin\AppData\Local\Temp\5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe
"C:\Users\Admin\AppData\Local\Temp\5e83d97f19b5a563560f1e004eab30c17275295cf0c8cf7641614f4f39c78d17.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Msv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Msv..bat

Filesize
274B

MD5
dcb6111a67f528157dd02de7a5651f5d

SHA1
f4b047dfc78c84eb268a1210fa9bcd6bee753dde

SHA256
d0a1c24b0cf3ac9b4ff6b0a08abc2a26bd1352157eccabf20e5320143c397dbd

SHA512
30e33ed823a61558eae60e850a378feabe0fb19cca1e5289ed16f406bef7bf17257505959cdb34e1c9430c8af59c71d0e59e74ea76a04516b231e0c343e477d5

Download Submit
memory/1264-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/1264-55-0x00000000003D0000-0x00000000003E4000-memory.dmp

Filesize
80KB

Download
memory/1264-56-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1264-58-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download