9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4

Analysis

max time kernel
57s
max time network
73s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 20:54

Target

9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe
Size

113KB
MD5

166432e968c23d23f93d07bdded564a7
SHA1

6337400e13cedf9664bf11879168b4b68eabad2c
SHA256

9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4
SHA512

d2e78687f662aa7c68689706cbe1f6655a014f7d2e8bc4a2b0bd11f91411fb06f96f54193466123693b7ac4079403f84857b017700765daf3b6bf487abbc2639
SSDEEP

3072:7uiBG6IggKenHasq9y25XquxAzflFEHURitEHyp+xAFSdsmFIb:0ggKen6sQy+quegw1AF/1

Score

7^/10

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

788 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
788	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe

description	pid	process	target process
PID 1980 wrote to memory of 788	1980	9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe	cmd.exe
PID 1980 wrote to memory of 788	1980	9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe	cmd.exe
PID 1980 wrote to memory of 788	1980	9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe	cmd.exe
PID 1980 wrote to memory of 788	1980	9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe
"C:\Users\Admin\AppData\Local\Temp\9b163cd8f8e5414dcefcefb3f515bf78fa43ae6349351df55043a70631e5a3d4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Blj..bat" > nul 2> nul
2⤵
- Deletes itself
PID:788

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Blj..bat

Filesize
274B

MD5
0e2bf90621d2991e61ae7507ea8fb939

SHA1
cf7ad50e553fdee7fbcea5fb5fd5a5d1f9667a49

SHA256
3a08d8d1956838b77e471a3e2736c07a8fbebf0a3c517cd78b2a1f8c413fe0f5

SHA512
08c2af757e4fc9907a3992b67592e0981632d587c59d9f96c2b883b5b8b764fd41b2a0aa0b3db1938944a3a73c17ac39f9926f448eb97be4fe66b03f4e91ce3a

Download Submit
memory/788-57-0x0000000000000000-mapping.dmp

Download
memory/1980-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1980-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1980-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1980-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download