87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d

Analysis

max time kernel
92s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d.exe
Size

408KB
MD5

2ef6adccad15140b74fe17fefd321d90
SHA1

154d49e1a8c8bcd3600bdd67e17ad40a676204fa
SHA256

87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d
SHA512

758ebf9b0fc6f5b3d79921e7ae405a1022a67cb767bece320cb67273bc0cad32748afe66bbbc33d06bb77c2cbcc4f828bfc6d7b28b88847f535dad6c9cb171fa
SSDEEP

12288:CnNeEJwnhmX2DDYklwZXY8Q0G41/MYz4rmR:CXX2/plw28nH1/Nko

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3312-132-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral2/memory/3312-134-0x0000000000400000-0x00000000004BC000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/3312-134-0x0000000000400000-0x00000000004BC000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d.exe

description	pid	process	target process
PID 3312 wrote to memory of 3424	3312	87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d.exe	cmd.exe
PID 3312 wrote to memory of 3424	3312	87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d.exe	cmd.exe
PID 3312 wrote to memory of 3424	3312	87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d.exe
"C:\Users\Admin\AppData\Local\Temp\87fd9f59793ce896ca228ddcd640e19dff9ac2b8014b8c396c5e2551c3015f2d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\s.cmd
2⤵
PID:3424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\s.cmd
Filesize
285B

MD5
d6f991b568c3c748a63d1565806095a7

SHA1
8f1a3e7c7c06568880a50bc753a5bc38a4716bd7

SHA256
bb5201120a3ef2635e4008d0e01a18d890d53714a89921673a9a4a2ecd62fa44

SHA512
9ebf9f086d6b3120be55f45aa7b1492250e7b450c26ec30b5702e649b5ec31f7211abafe395d094d8eee671f95f6489f5ec0ee7e407b550c028ab75bb754a6e6

Download Submit
memory/3312-132-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3312-134-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3424-133-0x0000000000000000-mapping.dmp

Download