49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4

Analysis

max time kernel
24s
max time network
55s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4.exe
Size

64KB
MD5

9dd5ecd5b528277de016e19c2bc28a23
SHA1

15d834c9c4ecd4735281d77e4e4640cabd3e7066
SHA256

49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4
SHA512

a3becd6e7cd0834ee3763983d49e6c538af4949401e25ed70629d8833813a09e908ede633bc5dd1a3fd154e472ab85f7572336293cb0735764380c600d5dc8a1
SSDEEP

1536:xET64WKch3dQzOwtwSI3yHBUJu5OXIvzpjIp/P:xq64Wx3dmqSSyHBknGzpjA/P

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
588	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 588	1736	49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4.exe	27
PID 1736 wrote to memory of 588	1736	49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4.exe	27
PID 1736 wrote to memory of 588	1736	49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4.exe	27
PID 1736 wrote to memory of 588	1736	49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4.exe	27

C:\Users\Admin\AppData\Local\Temp\49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4.exe
"C:\Users\Admin\AppData\Local\Temp\49c45a82644e7e8797494be3e3f567960885b5aedb0dec60d0f8ae3f320abdc4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Upz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Upz..bat

Filesize
274B

MD5
0bd39568dd73b7f0e1a59579f5da3dc7

SHA1
daaf61f0df77dc6b2bf8d9f01130b043064e55fc

SHA256
67bef09192f6912d147222b28787f77e7d83b7e8d7e65d0c3c9dabb7f6a6e9c6

SHA512
2683c8784841496e512bdd356d317547bc73d19924f835f94320bff564509cc3f4a17f4dc14edb664ba751d2c580889e0bfc19e0de6088550c201a8f2b0841c8

Download Submit
memory/1736-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1736-55-0x00000000759C1000-0x00000000759C3000-memory.dmp

Filesize
8KB

Download
memory/1736-56-0x00000000001C0000-0x00000000001D8000-memory.dmp

Filesize
96KB

Download
memory/1736-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1736-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1736-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download