83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6

Analysis

max time kernel
36s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 08:43

Target

83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe
Size

93KB
MD5

03a002741e0dc6b91e9149f11629db6f
SHA1

3bdf5082be9281aff9a54a18b5443ae1a27a2813
SHA256

83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6
SHA512

936c692f74e5bb4a985f2453a76d3301ad235017e1433668ca6142fff8b7cfd34177bbb14b3898959865ec4d9871be743937f45b3376f1d2b0ebffb6614915ba
SSDEEP

1536:zXitYdPtCa4tawS0uGWJC9KtwTfW6K8bgVk1BNKAPR:zXw7tac7WU9VTfW6K8bp1BEAP

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1492-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1492-58-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1712	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1492	83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1712	1492	83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe	28
PID 1492 wrote to memory of 1712	1492	83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe	28
PID 1492 wrote to memory of 1712	1492	83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe	28
PID 1492 wrote to memory of 1712	1492	83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe	28

C:\Users\Admin\AppData\Local\Temp\83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe
"C:\Users\Admin\AppData\Local\Temp\83d865a9ac6ea44f547c77ae87333d8a1ca5b48021e6be0b4ea556d5c72810f6.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bjj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1712

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Bjj..bat

Filesize
274B

MD5
dba0a1b5780b718fd133fde75ac5af66

SHA1
9fee99bb9f58d6637259b52f057973ef20ba0aeb

SHA256
9632fd7283a44b437d6108022cf6704f972de5cbbba3a62ad6fe8c578168865e

SHA512
4d611fceb4fb149a5059ac6e08bcfe0a7cf203061940712c6c321b1e24c68921aa84483eb9c6e1e95881cb737872653ccec1b14c354c21fda970207d8e8e244e

Download Submit
memory/1492-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x00000000000D0000-0x00000000000DC000-memory.dmp

Filesize
48KB

Download
memory/1492-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1492-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download