e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 14:39

Target

e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
Size

471KB
MD5

0e2b6f5309473ada6eb4d9e2fe13806e
SHA1

1608fefbcad407e9fe17f73e277e3b1af58b0ee9
SHA256

e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307
SHA512

17143d44498e141db116595aca405d95c47064663b4bb8952884d083c08c34ade5fbb14a55277b78c4ed35d4aba9603915e303626b1cc65b7353a42566669d32
SSDEEP

12288:3WWzzfSS7RjIARpEAWngrGMQQODqujFpgMaRrz3/kgoS8G:/RjIAMZMQDVT8RrLs6

Score

8^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1720-64-0x0000000000400000-0x00000000004EF000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1720-64-0x0000000000400000-0x00000000004EF000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27
PID 1720 wrote to memory of 1100	1720	e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe	27

C:\Users\Admin\AppData\Local\Temp\e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
"C:\Users\Admin\AppData\Local\Temp\e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe
  "C:\Users\Admin\AppData\Local\Temp\e763eb60e176f6a42375dc456c73e9bd5cfefa9bde9ae0f33b0271e70715a307.exe"
  2⤵
  PID:1100

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1100-56-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1100-55-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1100-58-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1100-59-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1100-61-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1100-66-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/1720-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/1720-64-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download