bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc

Analysis

max time kernel
54s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 04:54

Target

bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe
Size

142KB
MD5

8bdb995ef9ed85bb171bed0c751b90e3
SHA1

ce82127f1b928cf1b3d2dc57dad5cb463ae2ef1a
SHA256

bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc
SHA512

f332601adb78256311e9945fb278156d84768ea6c9494f7cbb2b629848c02066f55478900791e5cc34aadd2013a375d33f0db968de16da02ca0ce6e790096269
SSDEEP

1536:99KV+zloDOnNbFrNWqe5zF7o7r1UAStso4mW72LpMMpMU9ud/3p6kDr0DVYkZPn2:99K2JUAw4R6jMjcwIBtW495552

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1404	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysWOW32	bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1684	bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe
1684	bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1404	1684	bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe	29
PID 1684 wrote to memory of 1404	1684	bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe	29
PID 1684 wrote to memory of 1404	1684	bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe	29
PID 1684 wrote to memory of 1404	1684	bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe	29

C:\Users\Admin\AppData\Local\Temp\bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe
"C:\Users\Admin\AppData\Local\Temp\bdd5356aaaeec57e3a291985cbc3793c978887148c7f5ea55bab92171b967bdc.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\killfile.bat" "
  2⤵
  - Deletes itself
  PID:1404

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\killfile.bat

Filesize
301B

MD5
fc1be52de305b70ed7494dd5d44c5c3b

SHA1
3d74b44e5b43901127fd041025d2dd5f054d18f2

SHA256
6a82005e31ade2d74e283bc6d5d33fa499ef934f359f6ea3561f5d5743396a67

SHA512
e8df2a95b1d790f423642f7381b7dbbfc2887b2075344560f1aae534b91c1f2b5e5b544b1afc67038a7cab100189b3860dc578c1d3f1ccaf54de2fa51709a691

Download Submit
memory/1684-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download