18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15

Analysis

max time kernel
40s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/11/2022, 20:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15.exe
Size

97KB
MD5

50a20bc53bdfbbba262defabb10e7af2
SHA1

1e2d57820f9b9fe854c64eab52ebae50cd5874fa
SHA256

18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15
SHA512

e5d0cf42215bb2a964b5b106a287d9db7c0f4e744da3e453845e7cc3802cd710a7b39afe0623c5df2a01d77cc223f9080bf7704b40102cf6e8ea6bd0558b5c7c
SSDEEP

1536:o8YG+Yl6rhROR1d7EOAVHKK1LF+4J/n+KOLzCEPZEDIStEuOPCuTJolo4naeb:dfPGOkHtLF+4p+6EPuiKuTJoa4naeb

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1104	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 1104	1148	18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15.exe	27
PID 1148 wrote to memory of 1104	1148	18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15.exe	27
PID 1148 wrote to memory of 1104	1148	18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15.exe	27
PID 1148 wrote to memory of 1104	1148	18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15.exe	27

C:\Users\Admin\AppData\Local\Temp\18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15.exe
"C:\Users\Admin\AppData\Local\Temp\18b9182bc3cc01d0699fcc22db9237934ce738610e78ce8bfb750d4bc270ea15.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Abv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1104

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Abv..bat

Filesize
274B

MD5
9512a26a9f9c1097fa3da7b3458988c6

SHA1
3202fa351c6040b4702fc9a081a2df5e4a665ffd

SHA256
0cf32e4b75cd65182298ad5fdca1501909c6d868fe3fc445f535753c1a31d75f

SHA512
d4c2890fd39888655100a128bab90c1bdfb5aadb16aa3fd2146df424c62a50206ef4a0824133b3ce33a62cf3e6ba795d13850137cb5b1b39e063aaf52ee41a98

Download Submit
memory/1148-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/1148-55-0x0000000000230000-0x0000000000238000-memory.dmp

Filesize
32KB

Download
memory/1148-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1148-58-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download