4cc5e2db8ba5c8fcdbe0083d1891a6b18ce490698ce43be828435b7620548dac

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4cc5e2db8ba5c8fcdbe0083d1891a6b18ce490698ce43be828435b7620548dac.exe
Size

447KB
MD5

1ed9abe99f90bd5ed3e3a816ced33903
SHA1

ed5bb934790ed994912b65a895d20402b4fc86c6
SHA256

4cc5e2db8ba5c8fcdbe0083d1891a6b18ce490698ce43be828435b7620548dac
SHA512

39a611f6ebd83c9cd7d3d2e0630b74c186a4cae52aaef1b58722dd306c4a253e333ba16b3104faf0d4e8bde08e8109a6f32f310dcd3d3612ccd3fb046dc79f60
SSDEEP

6144:yo0XjJgmx9jfumGiKW+s+9H/WdLb9lJ9uEji0s5hmylPdiloD:ybGHJDfuX939uewlVile

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1652-55-0x0000000001000000-0x0000000001098000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\4cc5e2db8ba5c8fcdbe0083d1891a6b18ce490698ce43be828435b7620548dac.exe
"C:\Users\Admin\AppData\Local\Temp\4cc5e2db8ba5c8fcdbe0083d1891a6b18ce490698ce43be828435b7620548dac.exe"
1⤵
PID:1652

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1652-54-0x00000000758C1000-0x00000000758C3000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000001000000-0x0000000001098000-memory.dmp

Filesize
608KB

Download