ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508

Analysis

max time kernel
38s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 16:47

Target

ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe
Size

72KB
MD5

720be26c787696c9f6bd3d56909910ab
SHA1

06962fdff0915d2eac8b1316a27c8aeebbfab71b
SHA256

ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508
SHA512

b96821c9b77981d3e1a7a6f51dfc51d5a66489c7ad29de41b81883b7433adf96e51c7ef67fd74178812b81c2891485cee801e8bd6e0392616289f63fb84405de
SSDEEP

1536:WzeML9ihxoI+rtyWASIC4qrFfpFF60a8U3/HN1t8rn7IPCFiR3fsk6+/vmjof:WzShxoI+rty+IjqrLa8UvNzLPjfsXo

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1104-56-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/1104-57-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/1104-59-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1924	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1104	ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1924	1104	ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe	27
PID 1104 wrote to memory of 1924	1104	ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe	27
PID 1104 wrote to memory of 1924	1104	ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe	27
PID 1104 wrote to memory of 1924	1104	ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe	27

C:\Users\Admin\AppData\Local\Temp\ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe
"C:\Users\Admin\AppData\Local\Temp\ca966d2fd08bc57130ec7813fffcd38c90d8414c267d70f40d728e30d1108508.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Pfz..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1924

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Pfz..bat

Filesize
274B

MD5
670421f48da71e11ba68aa6d34965846

SHA1
dda5dc361b58fbfb0937757a7a0045b0ff29aa74

SHA256
8f0d088f09951517ee4891f6c2ea1161e03edaa85e103e272c73f53c63a354ce

SHA512
cb6458b650535a5a66d3fa9d8474e2dab2206b98399575459ccb1b3b521ef7f306f98b4f31783f05c1194a1a83ba2f8b57ec21dcee012d46b5edc930c0868fe0

Download Submit
memory/1104-54-0x0000000075131000-0x0000000075133000-memory.dmp

Filesize
8KB

Download
memory/1104-55-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/1104-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1104-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1104-59-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download