a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197

Analysis

max time kernel
158s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe
Size

1013KB
MD5

a8cf327f63f544a6af4510fa03f74ccd
SHA1

88a50f86cce5e13908926255fed532037831e389
SHA256

a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197
SHA512

bf22da3f713be75aa0f8cc3a75ed24b982b4dd552080e961ed7d206b604417e9109a03511d7fa3044a6a90d1fd68414e20d198a632e2e7e25a29b6ef20666ebd
SSDEEP

12288:nGFXPgj5yV2DFFXQeqwYX1XpgztJdszAcBoTCovmUCSFkgO/g7dAk+ude/icqchC:n4gWqQeSrWpV+otvmazO/gBAn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

568 schtasks.exe

pid	process
568	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe

description	pid	process	target process
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe
PID 932 wrote to memory of 568	932	a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe
"C:\Users\Admin\AppData\Local\Temp\a6cb24ec48c182bfa461e9a8a07bf66de2ded535473b5e5e5c6abca513132197.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:932

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\APXlexmRNedQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4AE6.tmp"
2⤵
- Creates scheduled task(s)
PID:568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:1948

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4AE6.tmp
Filesize
1KB

MD5
1d6c7e31a180147f8cc557f3e248cbeb

SHA1
6f5a6d3663bbfdd9ba5aad653307aac5be43f968

SHA256
bd7d61ebf14783954657e8728fc71bf8391353c6fc4077ee0af78b3bf35e9bdb

SHA512
222adaedd2549d300f27c5308011e0da9aa1d955a024feaa072e211ed80f64af81945ae04fa66b27b05c6f110562f89120a20261d2191d966e5b6d677f7746ea

Download Submit
memory/568-58-0x0000000000000000-mapping.dmp

Download
memory/932-54-0x0000000000E80000-0x0000000000F82000-memory.dmp

Filesize
1.0MB

Download
memory/932-55-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/932-56-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/932-57-0x00000000053F0000-0x0000000005478000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads