6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71.exe
Size

113KB
MD5

d2798b495525a91dc964ab5ac6dc2897
SHA1

aeef61c1d177916397c41107e22ee9489a0764c8
SHA256

6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71
SHA512

57c217f03140a8fbbcd527aa4da78ca50f06f20b9750e2d61d172107551027ec60b6abf7fd9c2a8aee08818bb7ac49fbd27ef7ab084b29d825c86147de6e3408
SSDEEP

3072:lemcyqFcEJrRL5JbfHmTy6ol2M5bh85VN+umgLFIq:li1Fz7mMkc18PNIgJ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
524	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 524	616	6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71.exe	28
PID 616 wrote to memory of 524	616	6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71.exe	28
PID 616 wrote to memory of 524	616	6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71.exe	28
PID 616 wrote to memory of 524	616	6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71.exe	28

C:\Users\Admin\AppData\Local\Temp\6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71.exe
"C:\Users\Admin\AppData\Local\Temp\6b55ff282260f60004e23c8dc088782511933cffc33609cc7e307a0bde82ee71.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pwj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Pwj..bat

Filesize
274B

MD5
2f9150da82724842cc329b7c72627d42

SHA1
863a0e92136ce5024b99c374c1abeed4505f5f9a

SHA256
6e24d218d8696f5f8631fd5d65a0cb1226539c0e5b5bf6f4b147f3b640ffa09a

SHA512
8bcae919c1c5b651166317278a9be470185d30941aa4b259b0e2d62bcd5df70cb59517cfe3a7e6d1821817cbc92f805adcd86b685a9a5df8c3239792e3029d01

Download Submit
memory/524-57-0x0000000000000000-mapping.dmp

Download
memory/616-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/616-55-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download
memory/616-56-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download
memory/616-58-0x0000000000400000-0x0000000000420A00-memory.dmp

Filesize
130KB

Download