8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041

Analysis

max time kernel
67s
max time network
81s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041.exe
Size

109KB
MD5

33f5f57b97808840073d8b81be0f0e45
SHA1

e322efeb75bde9ef06a9e8e6b2836a3cc8a6d609
SHA256

8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041
SHA512

090fb4fbd4eedbd9847d8e29063fd2aaac79a056843a05fa82bfb09bb1808f52863d9964474e8be93a441cd17c13a9e69a189aa4a26cc8faef5e0ea99e748eff
SSDEEP

3072:Mf2sgVxzgtYMgkwnmJQcY5vA0RDq3F3gJyiNX/v:Mf2D8zK0fYlATF3g8GX

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1744	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1744	1940	8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041.exe	28
PID 1940 wrote to memory of 1744	1940	8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041.exe	28
PID 1940 wrote to memory of 1744	1940	8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041.exe	28
PID 1940 wrote to memory of 1744	1940	8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041.exe	28

C:\Users\Admin\AppData\Local\Temp\8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041.exe
"C:\Users\Admin\AppData\Local\Temp\8102d4416e253bd979339a99ab56de300ef5eaab2a44263712236a6457bf0041.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Wkv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Wkv..bat

Filesize
274B

MD5
90247b8275515f1ee0a4bc80f9017a75

SHA1
d08d586e36df546ba466f598eec2c76e091d9cac

SHA256
88a3f7a9326acd5dfcdcdb2d5d30362a0880faf865cc8c4b419c372955269bf5

SHA512
5fa3740aae227a5ad2d9b31f2db7f4096970afec08dddfedca657203b2b1080bbc1016dc9b562c50b0e3ebf652802aefd2e0a9c96b50a6c9c7f6e6fd49377f3b

Download Submit
memory/1940-54-0x0000000000250000-0x0000000000263000-memory.dmp

Filesize
76KB

Download
memory/1940-55-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1940-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1940-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download