3581162aa8ebc433029bc6ca9237937f8775d79ca3dd51aa61254bf586b95111

Analysis

max time kernel
41s
max time network
73s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 10:45

Target

3581162aa8ebc433029bc6ca9237937f8775d79ca3dd51aa61254bf586b95111.exe
Size

445KB
MD5

c729476c0789734771c1ee3fe91bc410
SHA1

a8e22662ed30b74c8e842de60e8edc8e7b2cb5f6
SHA256

3581162aa8ebc433029bc6ca9237937f8775d79ca3dd51aa61254bf586b95111
SHA512

6b281732169db7e0881e58ded43e88f6da964bfc69cdadf3855b2c4fb1bdb605418d1a47ce61fda71e48a436496c9281d68057ee0649d5584c788ce470fb18b2
SSDEEP

12288:zXe9PPlowWX0t6mOQwg1Qd15CcYk0We1WIlaW1T:ahloDX0XOf4Vl11T

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1232-55-0x0000000000BF0000-0x0000000000CFE000-memory.dmp	upx
behavioral1/memory/1232-56-0x0000000000BF0000-0x0000000000CFE000-memory.dmp	upx
behavioral1/memory/1232-57-0x0000000000BF0000-0x0000000000CFE000-memory.dmp	upx

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1232-55-0x0000000000BF0000-0x0000000000CFE000-memory.dmp	autoit_exe
behavioral1/memory/1232-56-0x0000000000BF0000-0x0000000000CFE000-memory.dmp	autoit_exe
behavioral1/memory/1232-57-0x0000000000BF0000-0x0000000000CFE000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\3581162aa8ebc433029bc6ca9237937f8775d79ca3dd51aa61254bf586b95111.exe
"C:\Users\Admin\AppData\Local\Temp\3581162aa8ebc433029bc6ca9237937f8775d79ca3dd51aa61254bf586b95111.exe"
1⤵
PID:1232

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1232-54-0x0000000075C31000-0x0000000075C33000-memory.dmp

Filesize
8KB

Download
memory/1232-55-0x0000000000BF0000-0x0000000000CFE000-memory.dmp

Filesize
1.1MB

Download
memory/1232-56-0x0000000000BF0000-0x0000000000CFE000-memory.dmp

Filesize
1.1MB

Download
memory/1232-57-0x0000000000BF0000-0x0000000000CFE000-memory.dmp

Filesize
1.1MB

Download