9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2

Analysis

max time kernel
42s
max time network
50s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:15

Target

9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe
Size

148KB
MD5

4e2ceca1d81f79b234f870ed6f74f160
SHA1

57a6e1a2dedd6a9d7f93e748b03d7cec77cdd8f4
SHA256

9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2
SHA512

99b676f9182cde673882a30b93f9029f1ea17a018e699458f11dbd0848afe12c4bc3f88214a52e41dc2139243a4baf9b2ef061a034b5146f2b385a6ae3510e38
SSDEEP

3072:WqEioAY8RdwP9qzpL+pGtwOXzVxSOAuJ:+hRlERIG6cx

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

436 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
436	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe

description	pid	process	target process
PID 1748 wrote to memory of 436	1748	9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe	cmd.exe
PID 1748 wrote to memory of 436	1748	9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe	cmd.exe
PID 1748 wrote to memory of 436	1748	9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe	cmd.exe
PID 1748 wrote to memory of 436	1748	9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe
"C:\Users\Admin\AppData\Local\Temp\9f6a627fe893d236a6de90addf147616a04fa082461fc159710535e2793407b2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Cnj..bat" > nul 2> nul
2⤵
- Deletes itself
PID:436

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Cnj..bat
Filesize
274B

MD5
5fae2f6cc1a036a162eb370b1711e963

SHA1
dd54fe9cc8246bf74c4de03bfa0859f1df5bc941

SHA256
530740aaefe618615fad32b7df2cadccb50b68eee445528ecc88a059251aca39

SHA512
8c740dd6496b1c08233624ea35c547cafa912daac595da66d7fa21da9cf1cb92e666fac644a802e52c3422cc945901b5013915cc2e936e92510fbf36f15d2cca

Download Submit
memory/436-58-0x0000000000000000-mapping.dmp

Download
memory/1748-54-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1748-55-0x0000000000130000-0x0000000000145000-memory.dmp

Filesize
84KB

Download
memory/1748-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1748-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1748-59-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download