Analysis

  • max time kernel
    218s
  • max time network
    336s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 05:05

General

  • Target

    85baadccd43a7ac956c499e2b1d6af382001b9c49591faa8a71677f540dd64ff.exe

  • Size

    112KB

  • MD5

    84b6c4e328352dcc27e38229a3035554

  • SHA1

    d14807513cd880dbd08efedcb294f5f21ec8f10d

  • SHA256

    85baadccd43a7ac956c499e2b1d6af382001b9c49591faa8a71677f540dd64ff

  • SHA512

    9b67c2c3bb013c2385377ec479b765a0cab8d4368f0779f59e8e89b2bb27f83e08362551bd972a7080c90428c603c5f92c67be95767fccf0f1b45d51b05a5d6e

  • SSDEEP

    1536:z6znpBYnLkVhMZsY5937UOJM/Wv3mseoTWFfQRgXbsNthnZVdRlITJxATX78Dm/B:2OUoQoiidRyzATYEcpX8wtO6R8yG

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85baadccd43a7ac956c499e2b1d6af382001b9c49591faa8a71677f540dd64ff.exe
    "C:\Users\Admin\AppData\Local\Temp\85baadccd43a7ac956c499e2b1d6af382001b9c49591faa8a71677f540dd64ff.exe"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Lpv..bat" > nul 2> nul
      2⤵
      • Deletes itself
      PID:1204

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Lpv..bat

    Filesize

    274B

    MD5

    33ad47160c33e228edfc9ac37f37d6b4

    SHA1

    e5605f59dbeff6eaf832b546d5d618013650dfb3

    SHA256

    5da72ccdc30083447d93aa517a74d6aaf2f2a6a7475306602b4eafe2d03d03f1

    SHA512

    5c7726fb052ca6e99881d57d548a2dca84d7a6d3dd33686554aba4d6e0a95a1de04c2804fa667931e4bd79703cd9dcdc286262aa4a714cac6ca936e1af7edb2d

  • memory/716-54-0x0000000074E61000-0x0000000074E63000-memory.dmp

    Filesize

    8KB

  • memory/716-55-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

  • memory/716-57-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB