25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d

Analysis

max time kernel
186s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 18:32

Target

25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
Size

659KB
MD5

9a5f2bd95ed0c412f546ba5c2338fbf2
SHA1

ca783a9bb90910d2f6ab16caf5e12d1d69f53f32
SHA256

25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d
SHA512

79471818187410c8236409d818dc50e8f817feda25b07f51de0eb7fff4624c7a334c85b4539fe227e99d447e4ede7a0a04b2526ef18d5a49d847f6a2b517bdf3
SSDEEP

12288:vAyvpfnHq+NRkqR+RqgHvpRdEzWmLLuLAkyUyaAGY5OKCy5Z5DePzqh545+aXh5d:oyv5KAeqR+RqSHdEzJmfJixOKCy5Z5DI

Score

8^/10

upx

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4368-132-0x00000000022A0000-0x00000000023E6000-memory.dmp	upx
behavioral2/memory/4368-135-0x00000000022A0000-0x00000000023E6000-memory.dmp	upx
behavioral2/memory/4368-136-0x00000000022A0000-0x00000000023E6000-memory.dmp	upx
behavioral2/memory/4368-139-0x00000000022A0000-0x00000000023E6000-memory.dmp	upx
behavioral2/memory/4368-140-0x00000000022A0000-0x00000000023E6000-memory.dmp	upx
behavioral2/memory/4060-142-0x00000000021B0000-0x00000000022F6000-memory.dmp	upx
behavioral2/memory/4060-146-0x00000000021B0000-0x00000000022F6000-memory.dmp	upx
behavioral2/memory/4060-145-0x00000000021B0000-0x00000000022F6000-memory.dmp	upx
behavioral2/memory/4060-148-0x00000000021B0000-0x00000000022F6000-memory.dmp	upx
behavioral2/memory/4060-149-0x00000000021B0000-0x00000000022F6000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
Token: SeCreatePagefilePrivilege	4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 4060	4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe	84
PID 4368 wrote to memory of 4060	4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe	84
PID 4368 wrote to memory of 4060	4368	25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe	84

C:\Users\Admin\AppData\Local\Temp\25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
"C:\Users\Admin\AppData\Local\Temp\25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe
  "C:\Users\Admin\AppData\Local\Temp\25b74cdd11da258afe2216acc44be7ea9ca10f84fa3cbe2c9e1357ed89f2128d.exe" /_ShowProgress
  2⤵
  PID:4060

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/4060-149-0x00000000021B0000-0x00000000022F6000-memory.dmp

Filesize
1.3MB

Download
memory/4060-148-0x00000000021B0000-0x00000000022F6000-memory.dmp

Filesize
1.3MB

Download
memory/4060-147-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4060-145-0x00000000021B0000-0x00000000022F6000-memory.dmp

Filesize
1.3MB

Download
memory/4060-146-0x00000000021B0000-0x00000000022F6000-memory.dmp

Filesize
1.3MB

Download
memory/4060-142-0x00000000021B0000-0x00000000022F6000-memory.dmp

Filesize
1.3MB

Download
memory/4368-137-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4368-140-0x00000000022A0000-0x00000000023E6000-memory.dmp

Filesize
1.3MB

Download
memory/4368-139-0x00000000022A0000-0x00000000023E6000-memory.dmp

Filesize
1.3MB

Download
memory/4368-138-0x00000000021F0000-0x0000000002295000-memory.dmp

Filesize
660KB

Download
memory/4368-132-0x00000000022A0000-0x00000000023E6000-memory.dmp

Filesize
1.3MB

Download
memory/4368-136-0x00000000022A0000-0x00000000023E6000-memory.dmp

Filesize
1.3MB

Download
memory/4368-135-0x00000000022A0000-0x00000000023E6000-memory.dmp

Filesize
1.3MB

Download