adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 14:22

Target

adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe
Size

180KB
MD5

c270461a4d5c3fe1bc5d7c323a9e9be7
SHA1

94a373197993fe70cb4c938800c474e5e9e7bd15
SHA256

adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935
SHA512

6f6cefd52ff88f20f632da7f2a4d682d3f0b4f4c9317590c0d84a5e41ccd69f2d30e20b4f61717a4839024f5334b93d1744c1c22369fa43f07c5f6fe1d0afecf
SSDEEP

1536:A4CU+8uOZdegVb+sUmgj7lnb+oXMfGfHan89lG:AxU+8/ZFisUhjxn2fGf6D

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/852-56-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral1/memory/852-58-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
932	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
852	adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 932	852	adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe	27
PID 852 wrote to memory of 932	852	adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe	27
PID 852 wrote to memory of 932	852	adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe	27
PID 852 wrote to memory of 932	852	adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe	27

C:\Users\Admin\AppData\Local\Temp\adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe
"C:\Users\Admin\AppData\Local\Temp\adbff8e15845a91af27bd207e9f5ba24b537b4e639e16367f1a3267aa6a82935.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Klf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:932

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Klf..bat

Filesize
274B

MD5
b4302bf7c482202d9d0ef1ae55b6c32e

SHA1
15d2678d10cef099a79a31a66081852a412cb1cb

SHA256
615df2b214340fe2752add9c7dd4088b3ce724a3a9f3c72390ff3a545dd1edc3

SHA512
f4703fab378724c0bc1d5386a76746e4e39ff6426d718280e31616059467a73c3c9d2c27f58c583c40f75ea7762461b27adf8bbfe5bed253974b349230aaeeca

Download Submit
memory/852-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/852-55-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/852-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/852-58-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download