26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084

Analysis

max time kernel
108s
max time network
167s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe
Size

72KB
MD5

d79923ff7c0c6f5c396740b85a5561f8
SHA1

b5a1205198a85e8a85a73699e952a627924bd5a7
SHA256

26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084
SHA512

a94a0fee9857dd4d94d2da85363b4740b10c1f3a2b7051f0022e674310f4d3d0b2c7792b31987656d8f813ecf910d1ad5732a9cc19af30e4068898d2478f9299
SSDEEP

768:xDkfWemN0AQn7N6c2V7RfPrkHr8fxCU3imrGf+DmjpiMH19kF4x4UwNsQd4iSL:qfWeK0tgc2VVLpffqHjpp19VxRw6QLSL

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
684	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 684	1920	26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe	28
PID 1920 wrote to memory of 684	1920	26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe	28
PID 1920 wrote to memory of 684	1920	26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe	28
PID 1920 wrote to memory of 684	1920	26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe	28

C:\Users\Admin\AppData\Local\Temp\26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe
"C:\Users\Admin\AppData\Local\Temp\26eefdf76bba92c279fde6873a5c6b564d1c34df4e182a274566b1cd96092084.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wgz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wgz..bat

Filesize
274B

MD5
7f7e6405d7b3465bef763fef3f9159e0

SHA1
4bdb03aab0fc2d3b7a43d40b6320aef3de32df04

SHA256
52dd8e7415b8fdfd17dac27395570f491c53b05ece74e761b6adc64b177d3f02

SHA512
da38b827d63dc7c8c920628b828d84818255a728161452104a4ca0022867d811bf4a63addcbfbde33e66b071c9e115055dc91b5e18134ad9abf06a9362e54b44

Download Submit
memory/1920-54-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1920-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1920-56-0x0000000000230000-0x0000000000241000-memory.dmp

Filesize
68KB

Download
memory/1920-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1920-58-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1920-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download