8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156

Analysis

max time kernel
186s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
Size

832KB
MD5

1fdb8732b0bbc5fd328f9624cd6bb637
SHA1

42a62647664a1834d81e40fb3ad2b758c2f4565f
SHA256

8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156
SHA512

096765fb4b0d3c6b87b5ab91d4f6e5219fa9a4a2575ba2ab34f4eeee6fe54832e42189376c1b962276aeeb5e5fc2e68dbaee28b9906be0490ff16a820a07800d
SSDEEP

24576:othEVaPqL0dPizldLFvusj24sDVdzvTud:MEVUcmiz1C45

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1696-132-0x0000000000400000-0x00000000004C2000-memory.dmp	upx
behavioral2/memory/1696-136-0x0000000000400000-0x00000000004C2000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/1696-132-0x0000000000400000-0x00000000004C2000-memory.dmp	autoit_exe
behavioral2/memory/1696-136-0x0000000000400000-0x00000000004C2000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

description	pid	process	target process
PID 1696 set thread context of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

pid	process
1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

pid	process
1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

description	pid	process	target process
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
PID 1696 wrote to memory of 3528	1696	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe	8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe

C:\Users\Admin\AppData\Local\Temp\8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
"C:\Users\Admin\AppData\Local\Temp\8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe
"C:\Users\Admin\AppData\Local\Temp\8e627841bafe77ec4c91df1c8930aa6edc5ed1599e1e49373ce70dcce37f2156.exe"
2⤵
PID:3528

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1696-132-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1696-136-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3528-133-0x0000000000000000-mapping.dmp

Download
memory/3528-134-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3528-137-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download