89d2f519899c83c730725ff810a5e404346386f634d41ddffa366aded01d618e

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ransomy.bat
Size

76KB
MD5

ac7bd476884ac22af065c826c9a2c58f
SHA1

a02294112ff2e1fdfa74f9a756e60b6cfbabbb8c
SHA256

89d2f519899c83c730725ff810a5e404346386f634d41ddffa366aded01d618e
SHA512

230c25e85109aecc93768b98e65eccc9733a6179a891ff75bfcf4bcf588ae0287af8433037e87baf2b01169bfbbb82ea00eb9533e092a5bd9c0800d3c72f715d
SSDEEP

384:zqmB+m9dm9hm9rm99m93ml5mlomlumlSmlcmlsmlkmllmlZmjDmlfmn7mlJmlTmI:TjcIm8KcBn7Vl9oemQes2kL

Score

1^/10

Malware Config

Signatures

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2780	ipconfig.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2708	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	taskkill.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1228	1916	cmd.exe	29
PID 1916 wrote to memory of 1228	1916	cmd.exe	29
PID 1916 wrote to memory of 1228	1916	cmd.exe	29
PID 1916 wrote to memory of 1532	1916	cmd.exe	30
PID 1916 wrote to memory of 1532	1916	cmd.exe	30
PID 1916 wrote to memory of 1532	1916	cmd.exe	30
PID 1916 wrote to memory of 1892	1916	cmd.exe	31
PID 1916 wrote to memory of 1892	1916	cmd.exe	31
PID 1916 wrote to memory of 1892	1916	cmd.exe	31
PID 1916 wrote to memory of 2424	1916	cmd.exe	32
PID 1916 wrote to memory of 2424	1916	cmd.exe	32
PID 1916 wrote to memory of 2424	1916	cmd.exe	32
PID 1916 wrote to memory of 2992	1916	cmd.exe	33
PID 1916 wrote to memory of 2992	1916	cmd.exe	33
PID 1916 wrote to memory of 2992	1916	cmd.exe	33
PID 1916 wrote to memory of 2560	1916	cmd.exe	34
PID 1916 wrote to memory of 2560	1916	cmd.exe	34
PID 1916 wrote to memory of 2560	1916	cmd.exe	34
PID 1916 wrote to memory of 3036	1916	cmd.exe	35
PID 1916 wrote to memory of 3036	1916	cmd.exe	35
PID 1916 wrote to memory of 3036	1916	cmd.exe	35
PID 1916 wrote to memory of 2260	1916	cmd.exe	36
PID 1916 wrote to memory of 2260	1916	cmd.exe	36
PID 1916 wrote to memory of 2260	1916	cmd.exe	36
PID 1916 wrote to memory of 2596	1916	cmd.exe	37
PID 1916 wrote to memory of 2596	1916	cmd.exe	37
PID 1916 wrote to memory of 2596	1916	cmd.exe	37
PID 1916 wrote to memory of 2668	1916	cmd.exe	38
PID 1916 wrote to memory of 2668	1916	cmd.exe	38
PID 1916 wrote to memory of 2668	1916	cmd.exe	38
PID 1916 wrote to memory of 2680	1916	cmd.exe	39
PID 1916 wrote to memory of 2680	1916	cmd.exe	39
PID 1916 wrote to memory of 2680	1916	cmd.exe	39
PID 1916 wrote to memory of 2696	1916	cmd.exe	40
PID 1916 wrote to memory of 2696	1916	cmd.exe	40
PID 1916 wrote to memory of 2696	1916	cmd.exe	40
PID 1916 wrote to memory of 2720	1916	cmd.exe	41
PID 1916 wrote to memory of 2720	1916	cmd.exe	41
PID 1916 wrote to memory of 2720	1916	cmd.exe	41
PID 1916 wrote to memory of 2708	1916	cmd.exe	42
PID 1916 wrote to memory of 2708	1916	cmd.exe	42
PID 1916 wrote to memory of 2708	1916	cmd.exe	42
PID 1916 wrote to memory of 2780	1916	cmd.exe	44
PID 1916 wrote to memory of 2780	1916	cmd.exe	44
PID 1916 wrote to memory of 2780	1916	cmd.exe	44
PID 1916 wrote to memory of 2488	1916	cmd.exe	45
PID 1916 wrote to memory of 2488	1916	cmd.exe	45
PID 1916 wrote to memory of 2488	1916	cmd.exe	45

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2680	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ransomy.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt" "C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.enc"
  2⤵
  PID:1228
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt" "C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt.enc"
  2⤵
  PID:1532
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1F75.txt" "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1F75.txt.enc"
  2⤵
  PID:1892
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1FD7.txt" "C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI1FD7.txt.enc"
  2⤵
  PID:2424
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1F75.txt" "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1F75.txt.enc"
  2⤵
  PID:2992
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1FD7.txt" "C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI1FD7.txt.enc"
  2⤵
  PID:2560
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230901_013010_697.txt" "C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230901_013010_697.txt.enc"
  2⤵
  PID:3036
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230901_013011_945.txt" "C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20230901_013011_945.txt.enc"
  2⤵
  PID:2260
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\FXSAPIDebugLogFile.txt" "C:\Users\Admin\AppData\Local\Temp\FXSAPIDebugLogFile.txt.enc"
  2⤵
  PID:2596
- C:\Windows\system32\certutil.exe
  certutil -encode "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230901_012943179-MSI_netfx_Full_x64.msi.txt" "C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20230901_012943179-MSI_netfx_Full_x64.msi.txt.enc"
  2⤵
  PID:2668
- C:\Windows\system32\attrib.exe
  attrib +h C:\Users\Admin\AppData\Local\Temp\ransomy.bat
  2⤵
  - Views/modifies file attributes
  PID:2680
- C:\Windows\system32\format.com
  format C: /Q /y
  2⤵
  PID:2696
- C:\Windows\system32\mode.com
  mode con cols=107 lines=41
  2⤵
  PID:2720
- C:\Windows\system32\taskkill.exe
  taskkill /f /im explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:2780
- C:\Windows\system32\findstr.exe
  findstr IPv4
  2⤵
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads