bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 16:48

Target

bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe
Size

62KB
MD5

2ded0bd74ae3b90a49ea769cad30cebb
SHA1

04ecc3c56b6a499c4650df6b1ba425835f2076dd
SHA256

bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df
SHA512

9a19f72a3b1fe5896ce864bfae36f7d95020a80d19fd6dad8b1ef307014f408830393795f7d88e501616f90a272cf4959aacbb6b834601bfd937d2f4522cd78a
SSDEEP

1536:eGPegsVpDKNSf+owoS9Po8TwYwMPtd/BqDIkp:5dCpKM+oGBbw6td/BWv

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1080-56-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1080-58-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1616	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1080	bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1616	1080	bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe	28
PID 1080 wrote to memory of 1616	1080	bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe	28
PID 1080 wrote to memory of 1616	1080	bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe	28
PID 1080 wrote to memory of 1616	1080	bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe	28

C:\Users\Admin\AppData\Local\Temp\bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe
"C:\Users\Admin\AppData\Local\Temp\bda2bca7f40acf23063ac502a18ac56ba1b6fecbb08447c88de9c5a65c94a6df.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Udf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1616

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Udf..bat

Filesize
274B

MD5
5a3ad466f62542203ef360305861e0f5

SHA1
ed6bf875af7d2d0c469c9e2c818cc941601bc8ac

SHA256
21bae9b5b8a207dc6904cf70bb38f041805d35ecc368ac4c4eec1a1c747dd997

SHA512
d1b267b3ad6cc9a08d3791538cd03769ca3f1f7fca20d5a038a2f7547dd6e83efc04a06cf5e3c50a4c7c5c988b3290d19b5dd704b1893870a9ebf88529cd923c

Download Submit
memory/1080-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1080-55-0x0000000000220000-0x0000000000225000-memory.dmp

Filesize
20KB

Download
memory/1080-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1080-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1616-57-0x0000000000000000-mapping.dmp

Download