715dc74adfac4d2125f1e2774e3a65f36b421d8a0463d59a2b60fbb72a238d07

Analysis

max time kernel
52s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2022 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

715dc74adfac4d2125f1e2774e3a65f36b421d8a0463d59a2b60fbb72a238d07.exe
Size

408KB
MD5

63ff4a65058db31514ae6e8adcfdd8c5
SHA1

1de6eb4898dd97bb398ee4cfe002bac4d6832d19
SHA256

715dc74adfac4d2125f1e2774e3a65f36b421d8a0463d59a2b60fbb72a238d07
SHA512

444f3c472b0a83cd7d10400c01a52538cc0d0af151cb86c45a99dfa1c8e6069a919facebccedc38eae3b6cc002d2d68b2ad1aa458dee8de036bea5e268e1de89
SSDEEP

12288:GODgXTwMb2t0N0tQ5+cJgX0t2t3cKZKxJs0B:D8Xmt0+tQ5dgzuEC

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4484-132-0x0000000000400000-0x000000000048A000-memory.dmp	upx
behavioral2/memory/4484-133-0x0000000000400000-0x000000000048A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4484	715dc74adfac4d2125f1e2774e3a65f36b421d8a0463d59a2b60fbb72a238d07.exe

C:\Users\Admin\AppData\Local\Temp\715dc74adfac4d2125f1e2774e3a65f36b421d8a0463d59a2b60fbb72a238d07.exe
"C:\Users\Admin\AppData\Local\Temp\715dc74adfac4d2125f1e2774e3a65f36b421d8a0463d59a2b60fbb72a238d07.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4484-132-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/4484-133-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download