42fccbdaa9b6dbb2240fa99373df07b29ced688aea2bef47b3f1f3444fc72731

Analysis

max time kernel
26s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

42fccbdaa9b6dbb2240fa99373df07b29ced688aea2bef47b3f1f3444fc72731.exe
Size

151KB
MD5

072bd02170d640963487a56beb34e4bf
SHA1

a88fdbba03665291c8fcd19c402bffc0fdd40c42
SHA256

42fccbdaa9b6dbb2240fa99373df07b29ced688aea2bef47b3f1f3444fc72731
SHA512

40f63295a803ad27f010fccc9fc79facd8f13e597938bb9e39a66f09e90aab6b58cd02ba9a9cef943b85fc64f340981d9896e1c5ce93ddbb7e6b4e147a0f19d5
SSDEEP

3072:mdd4txGwmT7yf0x0ab0/OMmcIU8PybJRnjgxQhHZGeG1Q5V:mLGxG/80ZM5f8PybjjgxS0eGe5V

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3032-132-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/memory/3032-135-0x0000000000400000-0x0000000000427000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\42fccbdaa9b6dbb2240fa99373df07b29ced688aea2bef47b3f1f3444fc72731.exe
"C:\Users\Admin\AppData\Local\Temp\42fccbdaa9b6dbb2240fa99373df07b29ced688aea2bef47b3f1f3444fc72731.exe"
1⤵
PID:3032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\temp\kim1.vbs"
  2⤵
  PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C kim1.bat
    3⤵
    PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\temp\kim1.bat

Filesize
321B

MD5
15414a9b034486afdd21642d0e0a6b91

SHA1
169c9291b5405c78ab410246d211011f194f7ddb

SHA256
ac664acd99e97433925c9e9e6b0aff7ece94e39c739da42cc03e6ee211b2cfd6

SHA512
81fe4eec27536ed40ae545550ee8b01ce9b213f500224eb6bfb347a71901a4ca040cbfafbc143012f8d4bee35a7a2770ff7f45cb0395c884093963caceea98e8

Download Submit
C:\Windows\temp\kim1.vbs

Filesize
119B

MD5
94097c039e324d372ba5216af3b71fe3

SHA1
4185054e3e3f848edb8c30119c3f5fd114644bca

SHA256
b1aca4164c377a4b9ce9b9372dca884c63311882cfb6b85d05e7b64174664739

SHA512
a502c64ab056151984024a2e9e4e8cec6ced0689ad25d344381c4999b53b6c43a11cf52a86481b834a2177eec97bad49cbe7ddabe00b0d3ab872a9611d891f9e

Download Submit
memory/3032-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3032-135-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download