5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade.exe
Size

228KB
MD5

1eedff77e2fbf24bc43b5b5ccc42ef03
SHA1

0e62e4389329249c61c04d0294116ac854131b78
SHA256

5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade
SHA512

79b85e0ba08fb4e4911d069daa86a1f488b7f36c3addd7a8a822f088a2372b1d7533e6e482313e1ddb5c4ee51a69882d350f7cf3671bdbd2733d52fadbad9476
SSDEEP

6144:cOSlUL8ti+gH6ffUF77w2xOdYB/7YppblwD+:AlULR6ffUF778F

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/632-132-0x0000000000400000-0x000000000049A000-memory.dmp	upx
behavioral2/memory/632-134-0x0000000000400000-0x000000000049A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5012	PING.EXE
3880	PING.EXE

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 1204	632	5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade.exe	82
PID 632 wrote to memory of 1204	632	5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade.exe	82
PID 632 wrote to memory of 1204	632	5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade.exe	82
PID 1204 wrote to memory of 5012	1204	cmd.exe	84
PID 1204 wrote to memory of 5012	1204	cmd.exe	84
PID 1204 wrote to memory of 5012	1204	cmd.exe	84
PID 1204 wrote to memory of 3880	1204	cmd.exe	85
PID 1204 wrote to memory of 3880	1204	cmd.exe	85
PID 1204 wrote to memory of 3880	1204	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade.exe
"C:\Users\Admin\AppData\Local\Temp\5a87610d07593f0bf9c05104c7cc4b78d27e0db9081ae82e3c141e5b935c0ade.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\Clear.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\PING.EXE
    Ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:5012
- - C:\Windows\SysWOW64\PING.EXE
    Ping -n 5 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Clear.bat

Filesize
311B

MD5
b2516cad198e3cc3b9eab93c8aac7355

SHA1
8ec09e125a4ddf929d9b6b6e978b36d9e991b575

SHA256
67c6cd79fadadb611a329cbc66825641b5e49bbbc1d13fca4ea2ef14a8223292

SHA512
770184a9911b7de7f1fea0e986fa84bc4fed0f33eff97e9d903f6ad21a0b5f0e5aeab6a25a3f017d550ebfdb740f0f65d7a0d014ba740385b1a253437a849aef

Download Submit
memory/632-132-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download
memory/632-134-0x0000000000400000-0x000000000049A000-memory.dmp

Filesize
616KB

Download