Analysis

  • max time kernel
    145s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 04:04

General

  • Target

    89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe

  • Size

    597KB

  • MD5

    8102b44bf1fec0d45dbf877b225c40b0

  • SHA1

    374535ff48daa4eda5c2ac1c76e6dc1a075260af

  • SHA256

    89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6

  • SHA512

    858b06615be46be78098766381724e58e3a449a5bd6ed533627d61f36a2b91d45bbfe87da059e6f476a70a5d470c84767488eb5d1cc271b79f512958400b74f7

  • SSDEEP

    12288:QnvpSu/qBIUxUwicfzGJeINbD3V5GaJDp/:QnvUGRwhSJ3Jtp

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe
    "C:\Users\Admin\AppData\Local\Temp\89d79f15fea75c7d66ec8e48f09452af1871c2991700cf1f0dba8a160b6160c6.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1600

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1600-132-0x0000000002240000-0x0000000002372000-memory.dmp

    Filesize

    1.2MB

  • memory/1600-135-0x0000000002240000-0x0000000002372000-memory.dmp

    Filesize

    1.2MB

  • memory/1600-136-0x0000000002240000-0x0000000002372000-memory.dmp

    Filesize

    1.2MB

  • memory/1600-138-0x00000000021A0000-0x0000000002236000-memory.dmp

    Filesize

    600KB

  • memory/1600-137-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1600-139-0x0000000002240000-0x0000000002372000-memory.dmp

    Filesize

    1.2MB

  • memory/1600-140-0x0000000002240000-0x0000000002372000-memory.dmp

    Filesize

    1.2MB