e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034

Analysis

max time kernel
67s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21/10/2022, 00:59

Target

e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
Size

668KB
MD5

4f02985586b3072db0664ca9fb79d8f0
SHA1

f8e47d19336321f4b479dec7f5a45a4e47b367f0
SHA256

e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034
SHA512

f7acfc71c8add74994cab82cbd64f522d62a55272576c4f67b73fc25f3ae7f935edcf02b9a52c512d4e872e146ba34ade6d5d3a922136c29ba34f356656fecc0
SSDEEP

12288:sAnvpTzrN6siGIA4x2GUtN27TJ3HT92cahy76t+Gk4QA:lnvB9PXeTUtN27Tl92cahy7Qkl

Score

8^/10

upx

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/2032-134-0x0000000002200000-0x0000000002341000-memory.dmp	upx
behavioral2/memory/2032-137-0x0000000002200000-0x0000000002341000-memory.dmp	upx
behavioral2/memory/2032-138-0x0000000002200000-0x0000000002341000-memory.dmp	upx
behavioral2/memory/2032-139-0x0000000002200000-0x0000000002341000-memory.dmp	upx
behavioral2/memory/1628-141-0x0000000002220000-0x0000000002361000-memory.dmp	upx
behavioral2/memory/1628-145-0x0000000002220000-0x0000000002361000-memory.dmp	upx
behavioral2/memory/1628-144-0x0000000002220000-0x0000000002361000-memory.dmp	upx
behavioral2/memory/1628-147-0x0000000002220000-0x0000000002361000-memory.dmp	upx
behavioral2/memory/2032-148-0x0000000002200000-0x0000000002341000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
Token: SeCreatePagefilePrivilege	2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1628	2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe	80
PID 2032 wrote to memory of 1628	2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe	80
PID 2032 wrote to memory of 1628	2032	e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe	80

C:\Users\Admin\AppData\Local\Temp\e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
"C:\Users\Admin\AppData\Local\Temp\e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe
  "C:\Users\Admin\AppData\Local\Temp\e771a9ceed07cb0768dd9516cf3b5ff0df9085b529931e38594742d61fa21034.exe" /_ShowProgress
  2⤵
  PID:1628

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1628-144-0x0000000002220000-0x0000000002361000-memory.dmp

Filesize
1.3MB

Download
memory/1628-141-0x0000000002220000-0x0000000002361000-memory.dmp

Filesize
1.3MB

Download
memory/1628-145-0x0000000002220000-0x0000000002361000-memory.dmp

Filesize
1.3MB

Download
memory/1628-146-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1628-147-0x0000000002220000-0x0000000002361000-memory.dmp

Filesize
1.3MB

Download
memory/2032-133-0x0000000002070000-0x0000000002118000-memory.dmp

Filesize
672KB

Download
memory/2032-134-0x0000000002200000-0x0000000002341000-memory.dmp

Filesize
1.3MB

Download
memory/2032-137-0x0000000002200000-0x0000000002341000-memory.dmp

Filesize
1.3MB

Download
memory/2032-138-0x0000000002200000-0x0000000002341000-memory.dmp

Filesize
1.3MB

Download
memory/2032-139-0x0000000002200000-0x0000000002341000-memory.dmp

Filesize
1.3MB

Download
memory/2032-132-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2032-148-0x0000000002200000-0x0000000002341000-memory.dmp

Filesize
1.3MB

Download