8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61

Analysis

max time kernel
140s
max time network
186s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe
Size

32KB
MD5

9c52e1677a0670f0285c7497b741433e
SHA1

3e3b62a1372a644f48541b4658a6d4b0025c09b8
SHA256

8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61
SHA512

2e0d51950c3fdbd348431c2ff12c803d91c28fefd02d16958f159bff3c8d418fc7db1a187b88450e48e0e22be09a7e96a7876a572e0b9855bb9cce7ba5593d2b
SSDEEP

768:G6k5nSb5yLtbwo9tENxMgxWlTYpkJfQQx:G1Sb5yNENHstYyJfB

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1496-55-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1496-58-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1496	8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe
1496	8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1068	1496	8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe	28
PID 1496 wrote to memory of 1068	1496	8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe	28
PID 1496 wrote to memory of 1068	1496	8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe	28
PID 1496 wrote to memory of 1068	1496	8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe	28
PID 1068 wrote to memory of 1400	1068	net.exe	30
PID 1068 wrote to memory of 1400	1068	net.exe	30
PID 1068 wrote to memory of 1400	1068	net.exe	30
PID 1068 wrote to memory of 1400	1068	net.exe	30

C:\Users\Admin\AppData\Local\Temp\8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe
"C:\Users\Admin\AppData\Local\Temp\8816a90ee1b5309ffe767b58ed000cb55c5535697a255edc88f6e9c403ba7e61.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop sharedaccess
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sharedaccess
    3⤵
    PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-54-0x0000000075881000-0x0000000075883000-memory.dmp

Filesize
8KB

Download
memory/1496-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1496-58-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download