27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135

Analysis

max time kernel
90s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135.exe
Size 1.5MB
Sample221201-y59kmagg29
SHA256 27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135
MD5 1f3b8ca0dc2794eb4651f9dff6491a7a
SHA1 44804e07c3d3975083b510ca285c0d1e1b84de89
SHA512 500ae7b4a9e06027a94d46f5a310cf261ff46d5dca469d077805859a94d66d63bc7aac654b72f3c3498c05e75cbd1947ea179b7cddbe407f797ddea672c4fb95
SSDEEP 24576:esSzlEqF+hVcOMwaakpUqja7DEqOnhBXIIPPXkDjGXtHxsG5MY5uccZQDvc:wl8eOMwjgUQa7DEFnhixqXtxsQucsQ4
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4528	irsetup.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0002000000022de2-133.dat	upx
behavioral2/files/0x0002000000022de2-134.dat	upx
behavioral2/memory/4528-135-0x0000000000400000-0x0000000000527000-memory.dmp	upx
behavioral2/memory/4528-136-0x0000000000400000-0x0000000000527000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4528	irsetup.exe
4528	irsetup.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4528	2696	27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135.exe	80
PID 2696 wrote to memory of 4528	2696	27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135.exe	80
PID 2696 wrote to memory of 4528	2696	27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135.exe	80

C:\Users\Admin\AppData\Local\Temp\27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135.exe
"C:\Users\Admin\AppData\Local\Temp\27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
  __IRAOFF:520716 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\27f2c84a136033e66ca62214ba8c836755ec38fa318848940ec26145f34c8135.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe
Size 440KB
SHA256 d95b5bf9ca97c1900de5357743282bab655d61d616606485088e1708559b7cf1
MD5 75ca7ff96bf5a316c3af2de6a412bd54
SHA1 0a093950790ff0dddff6f5f29c6b02c10997e0c5
SHA512 b8da86f2f1e908955254e5168d0447f479cec7815a8b081a7b38eb87187cb2eb992109c67e006361b96bc1529ee8abc9dc477d78e9ca565e43f5415b492771d4
SSDEEP 6144:JgHXCFdoW/HotZk9K0C4mXE7EbmSIPzjZivhzO2PJehlNAI04Jl47sHvEh4UjfzS:cyIIIzAClE7uDOch+h2ul/mJo
MD5 SHA1 SHA512 SSDEEP

Submit Download