ff460d1ee886c8d959a980cadddb616f71e7a4171bbd218e1aa845e3b8ffde63

Analysis

max time kernel
121s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 23:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff460d1ee886c8d959a980cadddb616f71e7a4171bbd218e1aa845e3b8ffde63.exe
Size

96KB
MD5

0ab2de189cb6ec41b01d079b72309664
SHA1

b858651b864277d868558d4549a928a555ba7a90
SHA256

ff460d1ee886c8d959a980cadddb616f71e7a4171bbd218e1aa845e3b8ffde63
SHA512

fcb4f4d8a1c972e2788b33ffc8c5d5912a0caed19e1c85b0cc9f13892365ff2e9768a1255c4aaf89e799aceabc24d2a8adad0fcb74fa72610ab26c7d40a70e9a
SSDEEP

1536:wWZ2f+Qi9MVMjxgMvQkrPcTNQE+Z6W+zQTIn4a4Px0kqRO0byD03aLnaByD7:wq1QuMVs2tkYpQE+Z66ZduRO0+zeBE7

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1756-132-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/1756-133-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral2/memory/1756-134-0x0000000000400000-0x000000000041A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	ff460d1ee886c8d959a980cadddb616f71e7a4171bbd218e1aa845e3b8ffde63.exe
1756	ff460d1ee886c8d959a980cadddb616f71e7a4171bbd218e1aa845e3b8ffde63.exe

C:\Users\Admin\AppData\Local\Temp\ff460d1ee886c8d959a980cadddb616f71e7a4171bbd218e1aa845e3b8ffde63.exe
"C:\Users\Admin\AppData\Local\Temp\ff460d1ee886c8d959a980cadddb616f71e7a4171bbd218e1aa845e3b8ffde63.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1756-132-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1756-133-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1756-134-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download