bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3

Analysis

max time kernel
38s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 08:49

Target

bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe
Size

105KB
MD5

41d5c4d4c8e72e697e66aa5596a56b6f
SHA1

ef8b75cf1c47c6c9a87db42d2f0228d5df3b69cb
SHA256

bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3
SHA512

bcbb18e1a5b78f1e22a55c63c8351e6e8e4d921dcf29d16ecfdbb7c68a46a836e7040ab3f4b48b69df46829fce7a7e693a1fbf44bfdb994661fdb300a12f38a5
SSDEEP

768:r+KGZdJueOxr1PuarJHlVBQavxWOf+u4Dt0XtCVJGCIzIsaJHRQCAxtXfq:rDGEr1PDVBQiWe+b0X0nEIs0RQtXy

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1976-56-0x0000000000400000-0x000000000047D000-memory.dmp	upx
behavioral1/memory/1976-58-0x0000000000400000-0x000000000047D000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1480	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1976	bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1480	1976	bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe	26
PID 1976 wrote to memory of 1480	1976	bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe	26
PID 1976 wrote to memory of 1480	1976	bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe	26
PID 1976 wrote to memory of 1480	1976	bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe	26

C:\Users\Admin\AppData\Local\Temp\bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe
"C:\Users\Admin\AppData\Local\Temp\bd3b71038e86725e3e7439bbdfac38f2fa31ce033d9d9644e6a3d8bab259acd3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1480

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
274B

MD5
723d585b4b7ecf6c41708a93ae657a66

SHA1
61af74b837335daf3c2cc51d86d701c001892989

SHA256
22a01fc6e9fb28a895c4e049321cf69e1bc119f52e3fa1a796c51a9dece0b969

SHA512
eb19afc604650c60838dfa35aa77b3d7e42a142b483ff430af32b341b20bae18e82ead249f67a9310ed6ef44f6c87de380fbb9f1162a491e98de67a1d4413a00

Download Submit
memory/1976-54-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1976-55-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1976-56-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1976-58-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download