9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe
Size

120KB
MD5

bd4d5e644dffe7d29ddfa27d56ce0994
SHA1

dbb861c29fbe6e042975990869d4c9c4989e9509
SHA256

9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952
SHA512

9680ac83e0cd90fe7ba34eb8be3ab28773cbb0559e92b9ac817beab7ade384f84887e2b8d55dc13d6c306b2646cd029f54d99d2e8360cf935419e3b03de8ef91
SSDEEP

3072:wkD9YQmSZ3k84l/5UGv7aXj1woCO827xLW:wkDzmSZXW/j7aXj1wBp27x6

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1540	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1540	2012	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe	28
PID 2012 wrote to memory of 1540	2012	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe	28
PID 2012 wrote to memory of 1540	2012	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe	28
PID 2012 wrote to memory of 1540	2012	9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe	28

C:\Users\Admin\AppData\Local\Temp\9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe
"C:\Users\Admin\AppData\Local\Temp\9987dc829ec8dc5e5cc764ba147e23b25b81a325cf72a4e36e55c0390f72a952.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Ehf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Ehf..bat

Filesize
274B

MD5
b62fd848be91507c72793f0106bfa426

SHA1
803f1c98b7de5a19a50d3686edf952219ecf7538

SHA256
838d3f65a8cddab2b98c2c90b0b2bfcd7617f5396ebec320c191b22823faf177

SHA512
18136b1b4da8ec0d2678f083a740063521bc37105f3b32156537ccc2cf9df963c81ab1b3276508e5c2c855404207dd4334c640f310d2c72f4489731c55ec9e3f

Download Submit
memory/2012-54-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2012-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download