6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35

Analysis

max time kernel
5s
max time network
45s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:24

Target

6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe
Size

103KB
MD5

11ced296cd64d3186ff10eb42f2197ed
SHA1

1407bdcf54f61486f974f17169ff796a6b259780
SHA256

6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35
SHA512

eab5726a9cbe2294bb578186d330ca0946163b3ad378110a3481c50fc3a1231482a03e419853be48fe736c6400df4dd90771aa38856889b44923a71aa6f5925d
SSDEEP

1536:CqJW3IBqpAXmqmuyBXSu6omC/w539lGzNP5x2d5shA73Y:dJW38/4EdVGNxxjhALY

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1164	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 1164	1812	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe	28
PID 1812 wrote to memory of 1164	1812	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe	28
PID 1812 wrote to memory of 1164	1812	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe	28
PID 1812 wrote to memory of 1164	1812	6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe	28

C:\Users\Admin\AppData\Local\Temp\6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe
"C:\Users\Admin\AppData\Local\Temp\6b1df59340db0276365c56028fe0db01637b20dcea41d699869fe6745ef3bc35.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Cbj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1164

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Cbj..bat

Filesize
274B

MD5
b2ce93421db03aebe2675fa21d6a7e2e

SHA1
029b7e2ce73deecc94b68bd4093b56439cd38f72

SHA256
4e2676970bbaf6399455c684f5b0a3f43259fd2af1025432c7b2c9b61819da97

SHA512
17776fcf16347e0d14421762e6d823681e6e5b48e01ccadfe4563df8d3540b8bcb94e7ed58f93c22c93644b5441058ba726099f8d7cba23818d6cbc4a2e038a4

Download Submit
memory/1812-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/1812-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1812-56-0x0000000000120000-0x0000000000129000-memory.dmp

Filesize
36KB

Download
memory/1812-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1812-59-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download