dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88

Analysis

max time kernel
30s
max time network
43s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:13

Target

dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe
Size

71KB
MD5

47fbde733cb95ed3259e8203efafdcc0
SHA1

8c065f4b57ead6cb98986fef39b0e52fa76dfab8
SHA256

dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88
SHA512

8b484e3b430ce6e7dabc65d59864c5a1dd3c49b9cfd3be3e349564f331b05af2caa4e1094b8c6c28315eb7361d360eb75ecbfc35bcbaf0b2a48efc6ba5e9b9ad
SSDEEP

1536:AJqTen/QJ97NoqKTKbmVDTaWKkX1HPn9RngXhCN1U0I/c6/a:A/n/QJ97NGaWvlHnn+h61tI/g

Score

8^/10

upx

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/2012-56-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2012-57-0x0000000000400000-0x0000000000425000-memory.dmp	upx
behavioral1/memory/2012-59-0x0000000000400000-0x0000000000425000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

268 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe

pid process

2012 dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe

pid	process
268	cmd.exe

pid	process
2012	dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe

description	pid	process	target process
PID 2012 wrote to memory of 268	2012	dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe	cmd.exe
PID 2012 wrote to memory of 268	2012	dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe	cmd.exe
PID 2012 wrote to memory of 268	2012	dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe	cmd.exe
PID 2012 wrote to memory of 268	2012	dc9053bc2fc55b3d30426adb06502925a0e145cd878707fcb1a74dfb7f498d88.exe	cmd.exe

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Rsj..bat" > nul 2> nul
2⤵
- Deletes itself
PID:268

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Rsj..bat

Filesize
274B

MD5
8a2df004687610ff4cedbc99a8eeac4c

SHA1
554b6546b4532d4c03ae4a11ec1c6209c64e7c16

SHA256
d41c20900af92931c9b7595690925eeea03c4cf256e82c97cb21f30b8b7ffb85

SHA512
96de5ddd2631efa6a44d3a6c0bb952e4e822512b2f457c1e5388e450ba148f23fb9bc8ba4f5723a32aee3d803bd3aba0048370996f3176345472a28a2eedbac3

Download Submit
memory/268-58-0x0000000000000000-mapping.dmp

Download
memory/2012-54-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2012-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2012-57-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2012-59-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download