dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a

Analysis

max time kernel
94s
max time network
74s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe
Size

95KB
MD5

dbe3cc87f75cc728fa2519786d555070
SHA1

d63c29bfcbd6b6889466e35ab76fa8b0ebafb50f
SHA256

dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a
SHA512

9584ab2d9445297260dbce624f3ec8b083e80c7fa453e579359dfc26f06870822b56394a6eb750e4188a32af70aabdf44be2868ed37b9f9a171df26f7263dc0a
SSDEEP

1536:kT3KuCzqahhTbcG0yZnFi0Seu9+2aLWdaAQzqj3D7QpHoSp7wpvFIy:hc0S/9wCdaxzqj3DEeSCpvFIy

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
940	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 940	1972	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe	28
PID 1972 wrote to memory of 940	1972	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe	28
PID 1972 wrote to memory of 940	1972	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe	28
PID 1972 wrote to memory of 940	1972	dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe	28

C:\Users\Admin\AppData\Local\Temp\dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe
"C:\Users\Admin\AppData\Local\Temp\dd1d888e7084e2f9d747d5ec71fb287e35c62695ecdb21d6991d64e37eece64a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Inb..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Inb..bat

Filesize
274B

MD5
0fac24a10cd378ebb4f99794b813de74

SHA1
f1906b979e2ed1a785807d1a7b67727d6077b1da

SHA256
d8a9328e9c5c629b1912fe1453738dfc6a6b7b75e9dec894293e01f175e4472a

SHA512
84ca2f4dd53b1e1fadc2121cd9175902b4a7a7ef1ae6a5af95edf9ffdd113afe1b13661d69d8069116a2653309c715558c2fb3e63343d37e3910db45155191bb

Download Submit
memory/1972-54-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/1972-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1972-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1972-59-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download