269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57

Analysis

max time kernel
44s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-01-2023 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe
Size

173KB
MD5

98d94ce0aa20fa2fad13f6152b6d790d
SHA1

9fc34ffb1b006cc91f8b451488774a7ad1f6034a
SHA256

269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57
SHA512

66342d0b65ad4b6992135c41c3f3a5270fc71d6f82be2d67b9fff53893545674a0ce5843683f446140db546a2587642eaad383d9b31d3c4acb96789b71f19ac5
SSDEEP

3072:LUBZ36A3AhfmuJewyPn97mJemhAI6Oz6wy5G9JPoP/2AYBZUM8N:LUrqA3AheuswyPn97mJthP1M5UI/2VBI

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
848	WinCMD.EXE

Loads dropped DLL 2 IoCs

pid	Process
1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe
1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 848	1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe	27
PID 1084 wrote to memory of 848	1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe	27
PID 1084 wrote to memory of 848	1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe	27
PID 1084 wrote to memory of 848	1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe	27
PID 1084 wrote to memory of 848	1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe	27
PID 1084 wrote to memory of 848	1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe	27
PID 1084 wrote to memory of 848	1084	269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe	27

C:\Users\Admin\AppData\Local\Temp\269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe
"C:\Users\Admin\AppData\Local\Temp\269db25a013fa72e982f4c087a055f9c549fdcd157565ca1fabadfcacb77ae57.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Users\Admin\AppData\Local\Temp\WinCMD.EXE
  "C:\Users\Admin\AppData\Local\Temp\WinCMD.EXE" EJEC U-
  2⤵
  - Executes dropped EXE
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WinCMD.EXE

Filesize
160KB

MD5
7af929e4c2405acfb32cb70b1b5485ff

SHA1
0d692a96fda24983a7b80a8c8b04723c0d0b97fc

SHA256
919ce5ffba0851bcb0efaeab3ccaad3d109f6042741f3b9adb851bafec6f7134

SHA512
d64d9d63bd54901c48b12575c2120997cfa847b794e8b79fd373d656f2e4c5901885043668e0e8ec60648edc0cd7732c4b41c532799c502e15082f04f544856f

Download Submit
\Users\Admin\AppData\Local\Temp\WinCMD.EXE

Filesize
160KB

MD5
7af929e4c2405acfb32cb70b1b5485ff

SHA1
0d692a96fda24983a7b80a8c8b04723c0d0b97fc

SHA256
919ce5ffba0851bcb0efaeab3ccaad3d109f6042741f3b9adb851bafec6f7134

SHA512
d64d9d63bd54901c48b12575c2120997cfa847b794e8b79fd373d656f2e4c5901885043668e0e8ec60648edc0cd7732c4b41c532799c502e15082f04f544856f

Download Submit
\Users\Admin\AppData\Local\Temp\WinCMD.EXE

Filesize
160KB

MD5
7af929e4c2405acfb32cb70b1b5485ff

SHA1
0d692a96fda24983a7b80a8c8b04723c0d0b97fc

SHA256
919ce5ffba0851bcb0efaeab3ccaad3d109f6042741f3b9adb851bafec6f7134

SHA512
d64d9d63bd54901c48b12575c2120997cfa847b794e8b79fd373d656f2e4c5901885043668e0e8ec60648edc0cd7732c4b41c532799c502e15082f04f544856f

Download Submit
memory/848-57-0x0000000000000000-mapping.dmp

Download
memory/848-60-0x0000000000400000-0x00000000004297B8-memory.dmp

Filesize
165KB

Download
memory/1084-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download