a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 07:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe
Size

88KB
MD5

801611bcb044ff41c0f38b50497da560
SHA1

97987a652308c4cc1bbbb3e1b4b60ca406a9592d
SHA256

a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa
SHA512

ba8eb20a521e6e95e088661495146aa5e2a5e1df373a27a1e79ff73e8103004240e45dfa516607a0b09f69d90f2e3b9cb7d965c688e499cd50c87b37ff491a8c
SSDEEP

1536:esrXFJekIsOnOCaRIj0oCudDF9DXQIdgikEH7m0:B7FJekX2jaRU0/IDFNQIdgrI

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1324-57-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1108	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1108	1324	a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe	27
PID 1324 wrote to memory of 1108	1324	a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe	27
PID 1324 wrote to memory of 1108	1324	a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe	27
PID 1324 wrote to memory of 1108	1324	a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe	27

C:\Users\Admin\AppData\Local\Temp\a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe
"C:\Users\Admin\AppData\Local\Temp\a76b845ddd7a9237a1f83013798f9a903d7518958d0a6759a545ca785a4d6caa.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Blj..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Blj..bat

Filesize
274B

MD5
07256811388ab33b3c182fa0b1b05c76

SHA1
aeb22e8cad0d31338c97ce6b7ad7cee9669eb408

SHA256
9702b9caac23d0230b0c8cdbe99714d167db0280ba11b3cbc9b30a5fb8d5a9d7

SHA512
168cfc499546202174c5232bd173b7369723f91a4c9431b67d2febdb0678b5815e67459399bbcede1b6bc7a54cd010da7c56208da2ff35a7e790e3d455eae655

Download Submit
memory/1324-54-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

Filesize
8KB

Download
memory/1324-56-0x0000000000230000-0x000000000023D000-memory.dmp

Filesize
52KB

Download
memory/1324-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download