f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd

Analysis

max time kernel
23s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:46

Target

f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe
Size

110KB
MD5

f9904307e62db4cfb2e7938391ff6e20
SHA1

5106ac48b5fa2d7e4028dae441f8ffa12eaab543
SHA256

f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd
SHA512

77a0cf4446c60d9a141c1c08f464d06b602e87fa192e3ec3ef1a8085bbc5782898d4f5d0e95c85fa16568fccbd14c2063b6acc1c174da06fb3d8b7bfd43608c1
SSDEEP

1536:DvgXhQc9SksQdfbu5wSopfGZL/2m4G07Sd:DgXhQI91u5ZoJOyX7S

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1448-55-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral1/memory/1448-56-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral1/memory/1448-58-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1904 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe

pid process

1448 f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe

pid	process
1904	cmd.exe

pid	process
1448	f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe

description	pid	process	target process
PID 1448 wrote to memory of 1904	1448	f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe	cmd.exe
PID 1448 wrote to memory of 1904	1448	f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe	cmd.exe
PID 1448 wrote to memory of 1904	1448	f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe	cmd.exe
PID 1448 wrote to memory of 1904	1448	f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe
"C:\Users\Admin\AppData\Local\Temp\f6de4ec4cdfcfacc9c8f040b85c4e2528c33fdc60b472cb5f22a43aeda444ebd.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1904

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
83efc1fec91bbdf864586c879629749b

SHA1
15535061b453d03dbe75fff3dd3daf3deaf9e6d7

SHA256
b15f27d574d81e6dc6fa89638e2bb50385b18c1912efa468591fd6d497867d28

SHA512
71d6d6e91a5bff0c10138fb164c573ab2337475ecf06eb1f18db1878f91ae6a08df36a248bfde21c606c21d3428b18b62996521a6755e721dabce804e832d2c0

Download Submit
memory/1448-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1448-55-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1448-56-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1448-58-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1904-57-0x0000000000000000-mapping.dmp

Download