ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00

Analysis

max time kernel
37s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe
Size

160KB
MD5

0dde593c4105ccac4b9705ba8289a3be
SHA1

0806e46c50a1537a6b8996e69222c7ed61f92aeb
SHA256

ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00
SHA512

6ddcb13e7f653ebdf14a9aed6008e413a5634426ce05702db232b08eac2aec4fa8204074161d748a0816d729ea4d8a12bd1090a47437cae503e7cdf233edb8b6
SSDEEP

3072:7kKZpCS0uj/jn8R6BgBwJfZqH7mTNbap2VftOphUg:7kaUSXzjGBGfYbQOp4fW

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1976	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1976	1708	ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe	26
PID 1708 wrote to memory of 1976	1708	ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe	26
PID 1708 wrote to memory of 1976	1708	ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe	26
PID 1708 wrote to memory of 1976	1708	ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe	26
PID 1708 wrote to memory of 1976	1708	ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe	26
PID 1708 wrote to memory of 1976	1708	ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe	26
PID 1708 wrote to memory of 1976	1708	ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe	26

C:\Users\Admin\AppData\Local\Temp\ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe
"C:\Users\Admin\AppData\Local\Temp\ae60dbc6135d97b55dc6f6e0bb1ef0bb0f10d32cc449377136dbeed87e6dba00.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bxz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Bxz..bat

Filesize
274B

MD5
8bc0ad0366b6ffb9d80c844e95b2155d

SHA1
01a6fc4cd5816a4d8d0c133ad588a377cc548496

SHA256
6b897bd26ad145ceea5b76490d25dd1d081a5c612363f1eb770e670e7f4a6c77

SHA512
660816de2bbaf49ee00004bb2f13089cac348e6d8cede41f01a3024561beea0e1e05d3908692c1b095261dce18082cc75148d8d7760bb60acf65fe94362e8030

Download Submit
memory/1708-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/1708-55-0x00000000004B0000-0x00000000004DD000-memory.dmp

Filesize
180KB

Download
memory/1708-56-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1708-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1976-57-0x0000000000000000-mapping.dmp

Download