926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc

Analysis

max time kernel
41s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe
Size

72KB
MD5

901cefa5768e9ee951e47698741ed46b
SHA1

058fd6d6ba654a5ade409a49738c3fc53bc4ecd7
SHA256

926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc
SHA512

123c27ccd4d0643823a1760ddad0a27468c71d25ec35cf337be556a2d891c7b81cf6553a74ecf6b066f096c39f27175ec4e429ca8956138fcb290356df5d415f
SSDEEP

768:xDkfWemN0AQn7N6c2V7RfPrkHr8fxCU3imrGf+DmjpiMH19kF4x4UwNsQd4iML:qfWeK0tgc2VVLpffqHjpp19VxRw6QLML

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
852	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1628	926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 852	1628	926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe	28
PID 1628 wrote to memory of 852	1628	926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe	28
PID 1628 wrote to memory of 852	1628	926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe	28
PID 1628 wrote to memory of 852	1628	926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe	28

C:\Users\Admin\AppData\Local\Temp\926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe
"C:\Users\Admin\AppData\Local\Temp\926d5c93246a2eee01751c44b621c7c33e1877b0139d45da19af5c604a46d4fc.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Hbp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hbp..bat

Filesize
274B

MD5
a01f01598296d31ce817a29c8b61186e

SHA1
0993dd4d4af7864ef43cf40d714810c162475923

SHA256
623a3832d10ab66dc4fa198a37618498176792809c601be2c37476e7e29f4aa6

SHA512
8db1e9bdfd3155ffa78bedadeb9d19e6f9fba214abc3ec154745487ac6991be8fd842068c8ceecee027a52545eb2422514d0ae4a1e71a983f4ce2c7e06be7053

Download Submit
memory/852-59-0x0000000000000000-mapping.dmp

Download
memory/1628-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1628-56-0x0000000000240000-0x0000000000251000-memory.dmp

Filesize
68KB

Download
memory/1628-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1628-58-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1628-60-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download