2ecd7124039ca128235de1600064cde7b8481b7223d74e97b6ff019772dcb4ac

Analysis

max time kernel
164s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ecd7124039ca128235de1600064cde7b8481b7223d74e97b6ff019772dcb4ac.exe
Size

592KB
MD5

9b960d3555a922b74a6f8cbc3ed777a2
SHA1

87d139a5bd8aa290292113a9ef3d40083793f899
SHA256

2ecd7124039ca128235de1600064cde7b8481b7223d74e97b6ff019772dcb4ac
SHA512

2b12bd256da2af86f14d6bfff5da489632758e3824f09173e1d185230ec03138dc4e52c004c03ce0ccab67a436ab29657512baf69321a9bab80aef3695490303
SSDEEP

6144:XcOp9GYAGwb0IVHOLXZcv5fSGxQ+qtJB8TwND7GbG2+k3isJ97sbl6lJdQ+Kj:Xc2rM0IVucv5/qtXxybG2+kSSCbl6lJs

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2280-132-0x0000000000400000-0x0000000000496000-memory.dmp	upx
behavioral2/memory/2280-133-0x0000000000400000-0x0000000000496000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2280-132-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe
behavioral2/memory/2280-133-0x0000000000400000-0x0000000000496000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\2ecd7124039ca128235de1600064cde7b8481b7223d74e97b6ff019772dcb4ac.exe
"C:\Users\Admin\AppData\Local\Temp\2ecd7124039ca128235de1600064cde7b8481b7223d74e97b6ff019772dcb4ac.exe"
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-132-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/2280-133-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download