80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe
Size

67KB
MD5

5d74f48be060fc3a28a857540bf367c7
SHA1

6f41201561af5879c09c354fc254ec39f0e0d41d
SHA256

80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6
SHA512

8e21dadf582b892534e5916526991a096d9f1050def38a9c8ce7801b9ee78ad4703cbe781783e9cb05c87dac4ad0dcc43f80451b3e2e99d89a302ebed2b1c4d3
SSDEEP

1536:2wetP10SuUdZuhRfUwvw37j/XrTnEmgIFlkFVtJ/q:2vc0ZupIrj/XzD4d/q

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2040	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1784	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2040	1784	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe	28
PID 1784 wrote to memory of 2040	1784	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe	28
PID 1784 wrote to memory of 2040	1784	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe	28
PID 1784 wrote to memory of 2040	1784	80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe	28

C:\Users\Admin\AppData\Local\Temp\80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe
"C:\Users\Admin\AppData\Local\Temp\80b7a0c310b1d8bdf51b129172f6ccc4e849d8aca498810d6332d225862763f6.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ezb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ezb..bat

Filesize
274B

MD5
87385e039e1670a4ce00d11267f309cc

SHA1
d7a8724b3f915595e3d79de067cee24b29337467

SHA256
61bd1a1b1f364c29f21a6f8b613318be47b412f094fb48b7de63ff29bdbb138b

SHA512
9ab73c681fd6b25f4a9476061d14046f099b141f82b7abe6f743e1e0a042d5b584d9738174d4a74929f52e95402333cabb4b8e09765ce6f64b49bc47012c9b48

Download Submit
memory/1784-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1784-55-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1784-56-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1784-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1784-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download