2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5

Analysis

max time kernel
34s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 10:59

Target

2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe
Size

74KB
MD5

50c60dfe69caf4ebc016af0e8acd0c00
SHA1

b89eabfd5ee4ff4fbbe788d2a31bb3b0e2119437
SHA256

2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5
SHA512

e437313526a827cbd520037587191a7b8c7c68d43ab2aad8a5cb9aebbf9e39e72f732f06512927a313cda187e652ab5c7356a92acd849e275300e43af6ae32ca
SSDEEP

1536:f3gBrblld1Re0BLmFubF83km6Wc2cztFIJA0WmTj:f3gBrblldSo4ubAkmldczt+j

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/832-55-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/832-57-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
2020	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
832	2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2020	832	2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe	26
PID 832 wrote to memory of 2020	832	2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe	26
PID 832 wrote to memory of 2020	832	2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe	26
PID 832 wrote to memory of 2020	832	2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe	26

C:\Users\Admin\AppData\Local\Temp\2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe
"C:\Users\Admin\AppData\Local\Temp\2b8a50c3a1cc4f2b2bac888586521e998c99edc0ea4c827218e181eace341bc5.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Jlv..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2020

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Jlv..bat

Filesize
274B

MD5
69ecd7d85d1289bb9671437174ac15cf

SHA1
e56eefdb3809ad9674ab23f8497a96be450c1b65

SHA256
d4bea3d58251237e43d824aa5fb93c27a4caf6da06cc768917ecc0d8fb49131f

SHA512
057e2f3650eec98ce3c3fc05672bcb627ab0abffb34ecedf4d44263f64970f0470e1c0dc6a3905d7d5d65e089582d338bf053b924179ff69aac762fb9eb1fa1d

Download Submit
memory/832-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/832-55-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/832-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download