ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9

Analysis

max time kernel
102s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe
Size

198KB
MD5

054ca4cd6c994443816ec95f2b46f913
SHA1

a95eb29821a68b5ac5b60fe68503ae2808e6e645
SHA256

ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9
SHA512

fcb6ea3e63c15f2470487d3100191818924da0707ea181daa8f46f02d96ff347b9ce9a3046eaf3c321bfecbb1f476fe69662319e4aea717b7587166dded8cc44
SSDEEP

3072:OswFVHWulNf6XyNKsCp7a/EliKxfJkxbPL1dypZQaSJVr+1OB:NYcyMyGxw1dy7QaSDrYy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1992	cmd.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
364	PING.EXE
812	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1996	ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1992	1996	ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe	28
PID 1996 wrote to memory of 1992	1996	ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe	28
PID 1996 wrote to memory of 1992	1996	ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe	28
PID 1996 wrote to memory of 1992	1996	ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe	28
PID 1992 wrote to memory of 364	1992	cmd.exe	30
PID 1992 wrote to memory of 364	1992	cmd.exe	30
PID 1992 wrote to memory of 364	1992	cmd.exe	30
PID 1992 wrote to memory of 364	1992	cmd.exe	30
PID 1992 wrote to memory of 812	1992	cmd.exe	31
PID 1992 wrote to memory of 812	1992	cmd.exe	31
PID 1992 wrote to memory of 812	1992	cmd.exe	31
PID 1992 wrote to memory of 812	1992	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe
"C:\Users\Admin\AppData\Local\Temp\ccf27a66e44f7bbb2fb8c3ff50c48a0137fa39d7bcf7be8bc3cbc8c6d2a665f9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\\MoveFile.bat
  2⤵
  - Deletes itself
  - Enumerates connected drives
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\PING.EXE
    ping -a 127.1
    3⤵
    - Runs ping.exe
    PID:364
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.1
    3⤵
    - Runs ping.exe
    PID:812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MoveFile.bat

Filesize
339B

MD5
40b0506b475d189b818f5eb602e9e1da

SHA1
401573222b4697598d547d1baff1384e99cfc2cc

SHA256
f82aa9d7539e91bf1fc904edf186c8daf39839e82c6e3029fc815e1b87be50f4

SHA512
29871cb4c383636c77e3ed4d98960b226eb64e3a2d8ba06c3500cf28d127a8f9ecb7e0dced4145729232b2843962e2a7b31e0763c1c8d9c27a4886bdc660cdd7

Download Submit
memory/364-61-0x0000000000000000-mapping.dmp

Download
memory/812-63-0x0000000000000000-mapping.dmp

Download
memory/1992-58-0x0000000000000000-mapping.dmp

Download
memory/1996-54-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1996-57-0x0000000075631000-0x0000000075633000-memory.dmp

Filesize
8KB

Download
memory/1996-59-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download