4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16

Analysis

max time kernel
113s
max time network
115s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 03:09

Target

4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe
Size

3.4MB
MD5

ab7c18ee7a0346e2a021b8da90af1e8c
SHA1

585967a65767e219f2dbdac89915dd660009a7e4
SHA256

4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16
SHA512

a22349b5af214f44e74446fc4c31f596603754a629a202668168961fcb06f93ac3ea1da1c5bf492098f81b1cc6188ed03e8bb22bdd7bdf46478fae268dd75d74
SSDEEP

98304:fz8zeiPaHnUXynSKnQp06VyVFkhsfCYSquB9MQvKoGBT8awTFLOAkGkzdnEVEFox:M8UXqQgFk2fABeoGBT8awTFLOyEFoKG

Score

7^/10

Deletes itself 1 IoCs

pid	Process
284	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sysWOW32	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1252	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe
1252	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1252	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 284	1252	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe	30
PID 1252 wrote to memory of 284	1252	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe	30
PID 1252 wrote to memory of 284	1252	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe	30
PID 1252 wrote to memory of 284	1252	4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe	30

C:\Users\Admin\AppData\Local\Temp\4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe
"C:\Users\Admin\AppData\Local\Temp\4df24a46639d7d3b0290de70a7efc22ddf022c9d8411aa0c2fbb3b7548c14c16.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\killfile.bat" "
  2⤵
  - Deletes itself
  PID:284

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\killfile.bat

Filesize
301B

MD5
07bfbdef3da8bbc561e7f9e68e3197ca

SHA1
7549fece37d0ab49c9222d3f977cbd29cce6a06d

SHA256
7d991721f260d3eb36d2101dbc5b509c91a6abe25db2eb8afdf1463734e567fd

SHA512
2cf59b1e8256613c67db29d4ca25b7760d6294342119547d5b643efdbd52de2f0db89a5ecd20e6ac7bd800d3a4291c574306084d932b027a9d5292a27583371b

Download Submit
memory/1252-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download