7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 11:58

Target

7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe
Size

143KB
MD5

999ed0b558534e9fffcf081626c63313
SHA1

fe62e76a23edae3d46623476cb5ea0770e1d36b3
SHA256

7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b
SHA512

d6661cc8c1ba6def71bb087132a9d041480aae5889293742c7bcc174112f31794aa87ffea26e65d96a365dc687be3594bf68850449fa882b2c0dd87ac5da6cf0
SSDEEP

1536:yL+hPQzDGDm8VjJU+ncIRE7/zp1wzBrz4:bPYDGDljJUaccC/0dQ

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1184-55-0x0000000000400000-0x0000000000479000-memory.dmp	upx
behavioral1/memory/1184-57-0x0000000000400000-0x0000000000479000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1748	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1184	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 1748	1184	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe	26
PID 1184 wrote to memory of 1748	1184	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe	26
PID 1184 wrote to memory of 1748	1184	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe	26
PID 1184 wrote to memory of 1748	1184	7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe	26

C:\Users\Admin\AppData\Local\Temp\7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe
"C:\Users\Admin\AppData\Local\Temp\7b95401aacb0b6ec351acef1f85e41b96cb7229296cec1b2e3070e6eb901b65b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1748

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
83ea40d5ba00a744e444d9b6c1e4b256

SHA1
173e12eaa5e0c29c3627b317aaf1abc655f66f9c

SHA256
2a641899741a17ec3e453adef69b8a93d1c058bfde65bbbe796e1e692a9a7416

SHA512
337bb79d324412fc416e06dd50d623bb1b325cc18c88f5111ec4f50bec4ada1bea4c076a4c9e5f4e06d5b458ee14ee8654d1c724310df19f0285558d9d5befc9

Download Submit
memory/1184-54-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

Filesize
8KB

Download
memory/1184-55-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1184-57-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download