8b22a2217bee9ce78033411abe89af6217aa2888b5ebb5f39a6e9494c009c6a9

Analysis

max time kernel
163s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b22a2217bee9ce78033411abe89af6217aa2888b5ebb5f39a6e9494c009c6a9.exe
Size

1.9MB
MD5

6478d8f06155df4ab039448329c56967
SHA1

a9278b6248eb87197481d96bfb55e0f6b914c664
SHA256

8b22a2217bee9ce78033411abe89af6217aa2888b5ebb5f39a6e9494c009c6a9
SHA512

dba1e4328413555ed9e049cb71b8363c011b6c4d87df1cd437fa71d92dca27b0be46dafbe438de9203b5bc0f307fd9bfd1b5f7f13f547ce846e7311eb6f4c31c
SSDEEP

49152:HvpvqWOS0B7uN2UeqzSqujdRBzAIxve4DdNsBniKpfKynky0lu:HhvqWOS0B7uNeqzSqujDBzAIxW4cBbnN

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4832-132-0x0000000000400000-0x0000000000584000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4832	8b22a2217bee9ce78033411abe89af6217aa2888b5ebb5f39a6e9494c009c6a9.exe

C:\Users\Admin\AppData\Local\Temp\8b22a2217bee9ce78033411abe89af6217aa2888b5ebb5f39a6e9494c009c6a9.exe
"C:\Users\Admin\AppData\Local\Temp\8b22a2217bee9ce78033411abe89af6217aa2888b5ebb5f39a6e9494c009c6a9.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4832-132-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download
memory/4832-133-0x0000000000660000-0x0000000000667000-memory.dmp

Filesize
28KB

Download
memory/4832-134-0x0000000000400000-0x0000000000584000-memory.dmp

Filesize
1.5MB

Download