8d3e41c5b7f29d72c2bfba8cd61220b71fc01b0563612acdc3fa844a79a76aa3

Analysis

max time kernel
34s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d3e41c5b7f29d72c2bfba8cd61220b71fc01b0563612acdc3fa844a79a76aa3.exe
Size

85KB
MD5

5b7b1ff3420de77f84cc4532dbe35119
SHA1

bd1b017ebb4aaf5061ee85e13fc2204af5b4c8da
SHA256

8d3e41c5b7f29d72c2bfba8cd61220b71fc01b0563612acdc3fa844a79a76aa3
SHA512

0cb4c204d941ebe80635916036e467d26da98154160f8ca84270195b3934a8bd5b08a3e4ff9f2c302f6ebdaf22f6e928f43c67f6cc03014797f9dee4115b2301
SSDEEP

1536:Dkm21ncIVGX6lYIKZmwQ94DR3SWbhlUZtzzORQTugPQJLvj12YnmrtnomVC:YB1rVGX9ZQ9kR3jb7uqIugPQHZcnrVC

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1928-55-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1928-56-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\8d3e41c5b7f29d72c2bfba8cd61220b71fc01b0563612acdc3fa844a79a76aa3.exe
"C:\Users\Admin\AppData\Local\Temp\8d3e41c5b7f29d72c2bfba8cd61220b71fc01b0563612acdc3fa844a79a76aa3.exe"
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-54-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1928-55-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1928-56-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download