c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13

Analysis

max time kernel
32s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13.exe
Size

76KB
MD5

7a7113620509e95b94a2449782321704
SHA1

dee41e78ea094929c0a24d90cbb96a1e107ccdb4
SHA256

c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13
SHA512

32a4a01975893428ac7c48a4e709ce0c9294c8526e0d1b302990597fdeb5402a27ad4f7e9e05ad3cfb82d2bec6179eddba62ded059ceec27268c47d8fa43fbe1
SSDEEP

1536:T6PpRd+ZB1hwh1wDyTr+8WMEZBHuBdq29h/xkfqY/:T6xRSB1XUrZWMOHiA2XA/

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1192	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 1192	1436	c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13.exe	27
PID 1436 wrote to memory of 1192	1436	c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13.exe	27
PID 1436 wrote to memory of 1192	1436	c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13.exe	27
PID 1436 wrote to memory of 1192	1436	c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13.exe	27

C:\Users\Admin\AppData\Local\Temp\c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13.exe
"C:\Users\Admin\AppData\Local\Temp\c7a9df0a68c9c7b8d3f0645594df56d8274bcc4222211a9bd56390b2de848e13.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Zzj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Zzj..bat

Filesize
274B

MD5
6d2cdad59f4126b1e0f8515408ea1557

SHA1
eb4dd5bdd50ba43931d6078385a0158d1ec52b54

SHA256
c7ea66ea17da150435a365ca3e0ead5894c442a659e2c14eeda157b1f69555e4

SHA512
a5428fb894847e49354283aa811c8ab7a9e8eac6fae0733e3f96b989a656baac2e949c02c02db3b58c165bffcc3e50d4f69ac15fb483d6234c9c472e7fbaaac8

Download Submit
memory/1436-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1436-55-0x00000000002C0000-0x00000000002E8000-memory.dmp

Filesize
160KB

Download
memory/1436-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1436-58-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download