f9f9ba4daac4d60a8f6456479a885c5ac6bbe89236c6988e1749620a3d3a1e91

Analysis

max time kernel
33s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9f9ba4daac4d60a8f6456479a885c5ac6bbe89236c6988e1749620a3d3a1e91.exe
Size

447KB
MD5

782330984e04bd395b770f255b6ab763
SHA1

406e133551fe02efe8c57e04d59a97c617cf7f0f
SHA256

f9f9ba4daac4d60a8f6456479a885c5ac6bbe89236c6988e1749620a3d3a1e91
SHA512

69be3c8d09aefe8b9c8704bba591988528c6db4c4324d29df28d783159ad7e7c98566e09659a217ec6768dd92d2e92f4ac89765da980396c80d9ea452cf99037
SSDEEP

6144:y60XjJgmx9jfumGiKW+s+9H/WdLb9lJ9uEYFWhs7YM2BszK:yFGHJDfuX939uV

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1388-55-0x0000000001000000-0x0000000001098000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\f9f9ba4daac4d60a8f6456479a885c5ac6bbe89236c6988e1749620a3d3a1e91.exe
"C:\Users\Admin\AppData\Local\Temp\f9f9ba4daac4d60a8f6456479a885c5ac6bbe89236c6988e1749620a3d3a1e91.exe"
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000001000000-0x0000000001098000-memory.dmp

Filesize
608KB

Download