90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710

Analysis

max time kernel
37s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 07:45

Target

90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710.exe
Size

114KB
MD5

e5570d6c56326715589c95844b7e201a
SHA1

219cd990f9ccaccc8c680825acf906b3e30620bf
SHA256

90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710
SHA512

ddb377e2fc98ab76c02e62d2fdb08fbd35027b4a090116e2bd2904b178105b93600b07b1b79732966132541554994f54994b5f1e16c2a580982c6aeda0efa7c4
SSDEEP

1536:9a8bHvFg6frxQStfr/kd47PkF3WSEx+aCitR9AfqNWucY:QePxTGStfLkd4DkF3vEx+GtbnfcY

Score

7^/10

Deletes itself 1 IoCs

pid	Process
1328	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1424 wrote to memory of 1328	1424	90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710.exe	26
PID 1424 wrote to memory of 1328	1424	90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710.exe	26
PID 1424 wrote to memory of 1328	1424	90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710.exe	26
PID 1424 wrote to memory of 1328	1424	90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710.exe	26

C:\Users\Admin\AppData\Local\Temp\90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710.exe
"C:\Users\Admin\AppData\Local\Temp\90ad1ca4fa673d0ccf3b8880993e2cf537e5f887ed1892da937f022ede7e3710.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ajv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1328

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Ajv..bat

Filesize
274B

MD5
bd2e13eec67f1bc5d63cdca9d2c0d1ae

SHA1
b3c2df44de097b987ce016332286b8a59c7920c9

SHA256
0a3720776f81c5a3d30ab0f24dd3e232e7f7ebc3b04bf83cd3999fe36f3748a3

SHA512
c05c3dd9e9d8eabeadcb5c23a318ac8cf8c06da12e8b28e75e48622bc6d4fbdc2486ef24da4fb4ef3cbbc8f331bfd724d2de422fe49777bb3b9020b251e5aef0

Download Submit
memory/1424-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download
memory/1424-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1424-56-0x0000000000220000-0x0000000000234000-memory.dmp

Filesize
80KB

Download
memory/1424-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1424-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download