46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b

Analysis

max time kernel
228s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe
Size

327KB
MD5

795675e887c5e5a6b4e03c14f305db30
SHA1

71e51057362f6284a1ee3af686d93bc9c2fd60d1
SHA256

46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b
SHA512

3b8102b971f898f9ac15dfe31de05daaddd7fc3f744aec3544a31b255d528069495a464d6a598715939529b32c740597bd5c184850ff7defec34c554238f174e
SSDEEP

6144:zuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qL3ks3ih1XGWz:q6Wq4aaE6KwyF5L0Y2D1PqLF3c2Q

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4216	commander.exe
1924	commander.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4456-132-0x0000000000400000-0x00000000004B6000-memory.dmp	upx
behavioral2/memory/4456-139-0x0000000000400000-0x00000000004B6000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4456-139-0x0000000000400000-0x00000000004B6000-memory.dmp	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\commander.exe	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svhost.exe	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe
File opened for modification	C:\Windows\svhost.exe	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe
4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4216	4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe	82
PID 4456 wrote to memory of 4216	4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe	82
PID 4456 wrote to memory of 4216	4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe	82
PID 4216 wrote to memory of 532	4216	commander.exe	84
PID 4216 wrote to memory of 532	4216	commander.exe	84
PID 4216 wrote to memory of 532	4216	commander.exe	84
PID 4456 wrote to memory of 1924	4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe	85
PID 4456 wrote to memory of 1924	4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe	85
PID 4456 wrote to memory of 1924	4456	46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe	85
PID 1924 wrote to memory of 3028	1924	commander.exe	87
PID 1924 wrote to memory of 3028	1924	commander.exe	87
PID 1924 wrote to memory of 3028	1924	commander.exe	87

C:\Users\Admin\AppData\Local\Temp\46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe
"C:\Users\Admin\AppData\Local\Temp\46fb442e2842dccad4d7e5159f57ce75d29bc974b7c80f7b860f81a444a1bb3b.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\commander.exe
  commander.exe /C at 9:00 /interactive C:\Windows\svhost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\at.exe
    at 9:00 /interactive C:\Windows\svhost.exe
    3⤵
    PID:532
- C:\Windows\SysWOW64\commander.exe
  commander.exe /C schtasks /run /tn at1
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /tn at1
    3⤵
    PID:3028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\commander.exe

Filesize
231KB

MD5
3517074d6958441a8c689cea98c1c878

SHA1
072d8ec9a1573e28e18b1df4939c8b1e2a964b25

SHA256
f7b5ecf998b69bc0b962fb6677e8d5e5c31a1c51a881b553bcad8de304c66e09

SHA512
4631968e1965ee274dba59d37461cd593d799e5e5fe733638dc98483059593cb67c321cef32790e9e9d659f1b4ccf6bde437d19820a5708bd5411c465661cf07

Download Submit
C:\Windows\SysWOW64\commander.exe

Filesize
231KB

MD5
3517074d6958441a8c689cea98c1c878

SHA1
072d8ec9a1573e28e18b1df4939c8b1e2a964b25

SHA256
f7b5ecf998b69bc0b962fb6677e8d5e5c31a1c51a881b553bcad8de304c66e09

SHA512
4631968e1965ee274dba59d37461cd593d799e5e5fe733638dc98483059593cb67c321cef32790e9e9d659f1b4ccf6bde437d19820a5708bd5411c465661cf07

Download Submit
memory/4456-132-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download
memory/4456-139-0x0000000000400000-0x00000000004B6000-memory.dmp

Filesize
728KB

Download