129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb

Analysis

max time kernel
167s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
Size

1.1MB
MD5

19c01d43cdc6d528432273c1bae370d0
SHA1

c773d67c5d2b1c536b45d29b11b80f7569611c1c
SHA256

129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb
SHA512

4e52798f828575b47fc17fdbc417e9a0b9c4ad2466023212cd9cd5cc8855ce7b6768abaab92f13651de0bde170ddc5af540048813752137dc54e8460d22726c9
SSDEEP

24576:ZthEVaPqLhkucnSfGJcG//+b91EBEq5tg:xEVUchkucnSOJc

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2996-132-0x0000000000400000-0x000000000052E000-memory.dmp	upx
behavioral2/memory/2996-136-0x0000000000400000-0x000000000052E000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/2996-136-0x0000000000400000-0x000000000052E000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

description	pid	process	target process
PID 2996 set thread context of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

pid	process
2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

pid	process
2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

description	pid	process	target process
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
PID 2996 wrote to memory of 1644	2996	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe	129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe

C:\Users\Admin\AppData\Local\Temp\129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
"C:\Users\Admin\AppData\Local\Temp\129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2996

C:\Users\Admin\AppData\Local\Temp\129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe
"C:\Users\Admin\AppData\Local\Temp\129934cf8cf1a6cfdfa2500be682f5fe1b494576cd87a5d14e2954da9053adfb.exe"
2⤵
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-133-0x0000000000000000-mapping.dmp

Download
memory/1644-134-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1644-137-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2996-132-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download
memory/2996-136-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download