c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9

Analysis

max time kernel
49s
max time network
52s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9.exe
Size

72KB
MD5

b14930659bc828e5c8acec020e3270c7
SHA1

283a7272d0345c497a7b23106b27c9ac59e78a91
SHA256

c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9
SHA512

88c05bdeab8a8ad2a6835a95d4a9dfd1be5492dfb6df7f3a16250916055d26a9c6cd2827abcbeacd15f42caba9c40b282f8de24b7790c20ac54de208e85ec965
SSDEEP

1536:K1UfG4FtE/r/I6uVOrFeGEIIwodsohNt4ZMwyVl:S4/2r/InpfINoz5we

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1936	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1936	1992	c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9.exe	27
PID 1992 wrote to memory of 1936	1992	c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9.exe	27
PID 1992 wrote to memory of 1936	1992	c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9.exe	27
PID 1992 wrote to memory of 1936	1992	c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9.exe	27

C:\Users\Admin\AppData\Local\Temp\c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9.exe
"C:\Users\Admin\AppData\Local\Temp\c56cd60fd27d55c242897334e1cec5401ce045c5c18a0a3e4131fa685ef2cff9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Tjf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tjf..bat

Filesize
274B

MD5
d9428c9fbf290724a0135bf9b4e216f6

SHA1
2ea01d6f9ca816beaf8c1d22139ec971417a553f

SHA256
6cede1858b21abefe473d926759b39baa0ace0aa5487342c63d1d8deb3a93334

SHA512
252b8a7fd468b7a0160a3320cd2356199a09f2acc241987bd6e24995a6b2fc37b94befde918fd932d620e72e86b6ed0ace70b042acecea8ee01650efda64079e

Download Submit
memory/1992-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1992-55-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1992-56-0x0000000000230000-0x000000000024B000-memory.dmp

Filesize
108KB

Download
memory/1992-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1992-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download