c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652

Analysis

max time kernel
34s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 16:47

Target

c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe
Size

65KB
MD5

d113a83024f5cd80c67089f0154dc028
SHA1

508479cfed7e073751b20927fecab90de7822efd
SHA256

c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652
SHA512

2fda4a1571beaeaed11fd1ab21045d23532b27478a4278c9f64e8f211e637d933eed95da94306ed6aa07bcbd5e262435fb5339697cf385009ab232c069cc2575
SSDEEP

1536:eN7n+xRckSJqxMyn5Ci6Ju6sq5Dqp42NEI1/2y9nL/z9rp5z:wsoqfn56dsqpqad6pr

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1992-55-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/1992-57-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
2024	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1992	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2024	1992	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe	26
PID 1992 wrote to memory of 2024	1992	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe	26
PID 1992 wrote to memory of 2024	1992	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe	26
PID 1992 wrote to memory of 2024	1992	c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe	26

C:\Users\Admin\AppData\Local\Temp\c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe
"C:\Users\Admin\AppData\Local\Temp\c6d998bafae77e84ace868fa7041f94c4b0b6cfe243df1168284a68b24f5f652.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Bmf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2024

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Bmf..bat

Filesize
274B

MD5
30d3cff442c1a9d6b5ed3f9eee404365

SHA1
43d625d7d7aeec80b13f96266596d5e8508416dc

SHA256
c940c6f1f88118c3ab475655978db2c288bee00bc5983c8a0a1b404192a2870b

SHA512
f3fb4781795fd4156dccb7abb62a2124b48488687cb1da16a142635203b46a54f25b3d5ea98f23677598c68ceed49f52201e5b20dad8c3033648c39f5911996b

Download Submit
memory/1992-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1992-57-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2024-56-0x0000000000000000-mapping.dmp

Download