cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b

Analysis

max time kernel
136s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe
Size

11.3MB
MD5

d9ab08c2d38084d6fdb428637e00b85a
SHA1

b5a77b2106b880d065719d286625a1040e489efb
SHA256

cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b
SHA512

4e1bea8043b78caf03e89b09b36fe5b7711932eae4b0e512659524140772b68131a9e3f8faf233b070b70eccb9160e72244fa024193c7c8b0ddee0ba7b653df4
SSDEEP

196608:AtrD5vWG4ov+Tbo16rHtPPf3znaXioTjSzT4SSGExCe2k:AtxF8hNPPvzaXZTjqToGKak

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1680 set thread context of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1696 wrote to memory of 1680	1696	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	27
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28
PID 1680 wrote to memory of 1768	1680	cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe	28

C:\Users\Admin\AppData\Local\Temp\cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe
"C:\Users\Admin\AppData\Local\Temp\cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Users\Admin\AppData\Local\Temp\cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe
  "C:\Users\Admin\AppData\Local\Temp\cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Users\Admin\AppData\Local\Temp\cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe
    "C:\Users\Admin\AppData\Local\Temp\cec0c44b64c327fe017f65e381e4c2d0e937f2c47cfbf6a31aed9ca024e32a5b.exe"
    3⤵
    PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1680-69-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-72-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-56-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-58-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-60-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-63-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-65-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-67-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-55-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-75-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-109-0x0000000010410000-0x00000000106F6000-memory.dmp

Filesize
2.9MB

Download
memory/1680-78-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-79-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-80-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1680-121-0x0000000013140000-0x0000000013519000-memory.dmp

Filesize
3.8MB

Download
memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1768-82-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-87-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-90-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-93-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-95-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-98-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-101-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-104-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-106-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-107-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-84-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-119-0x0000000010410000-0x00000000106F6000-memory.dmp

Filesize
2.9MB

Download
memory/1768-81-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-122-0x0000000010410000-0x00000000106F6000-memory.dmp

Filesize
2.9MB

Download
memory/1768-123-0x0000000000400000-0x0000000000613000-memory.dmp

Filesize
2.1MB

Download
memory/1768-124-0x0000000010410000-0x00000000106F6000-memory.dmp

Filesize
2.9MB

Download