a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197

Analysis

max time kernel
158s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 09:24

Target

a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe
Size

1013KB
MD5

a8cf327f63f544a6af4510fa03f74ccd
SHA1

88a50f86cce5e13908926255fed532037831e389
SHA256

a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197
SHA512

bf22da3f713be75aa0f8cc3a75ed24b982b4dd552080e961ed7d206b604417e9109a03511d7fa3044a6a90d1fd68414e20d198a632e2e7e25a29b6ef20666ebd
SSDEEP

12288:nGFXPgj5yV2DFFXQeqwYX1XpgztJdszAcBoTCovmUCSFkgO/g7dAk+ude/icqchC:n4gWqQeSrWpV+otvmazO/gBAn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

568 schtasks.exe

pid	process
568	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe

description	pid	process	target process
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe
"C:\Users\Admin\AppData\Local\Temp\a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\APXlexmRNedQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4AE6.tmp"
2⤵
- Creates scheduled task(s)
PID:568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1948

Initial Access

Execution

Scheduled Task

Persistence

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\tmp4AE6.tmp

Filesize
1KB

MD5
1d6c7e31a180147f8cc557f3e248cbeb

SHA1
6f5a6d3663bbfdd9ba5aad653307aac5be43f968

SHA256
bd7d61ebf14783954657e8728fc71bf8391353c6fc4077ee0af78b3bf35e9bdb

SHA512
222adaedd2549d300f27c5308011e0da9aa1d955a024feaa072e211ed80f64af81945ae04fa66b27b05c6f110562f89120a20261d2191d966e5b6d677f7746ea

Download Submit
memory/568-58-0x0000000000000000-mapping.dmp

Download
memory/932-54-0x0000000000E80000-0x0000000000F82000-memory.dmp

Filesize
1.0MB

Download
memory/932-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/932-56-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/932-57-0x00000000053F0000-0x0000000005478000-memory.dmp

Filesize
544KB

Download