ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d

Analysis

max time kernel
124s
max time network
126s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe
Size

393KB
MD5

1156b80d7c68bae38af88ecf13d3dc82
SHA1

fb1516b53adb0033c2fbe444c998990ec5a45e69
SHA256

ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d
SHA512

e6be56c6f650a4e77130f99bb92d822548123d92243631b1c08e5073b560de0c8cd6abe86961e3ad85a43dc5fc97f6e084723bba277f07f005e5aa3a3537f9ce
SSDEEP

6144:fhUxwUcIzRmQniqTHVt5q2SG8Q/peqLxQM1qgFI/z0XY76i1Qxt9Kok:uSK1m1qT1nq2drpnxQM1qgFI/szg9z

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1616	installer.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2000-55-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2000-64-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2000-65-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe
1616	installer.exe
1616	installer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1616	2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	28
PID 2000 wrote to memory of 1616	2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	28
PID 2000 wrote to memory of 1616	2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	28
PID 2000 wrote to memory of 1616	2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	28
PID 2000 wrote to memory of 1616	2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	28
PID 2000 wrote to memory of 1616	2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	28
PID 2000 wrote to memory of 1616	2000	ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe	28

C:\Users\Admin\AppData\Local\Temp\ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe
"C:\Users\Admin\AppData\Local\Temp\ada0b1c13577b1472ef72d58dfef1fd291b624e0cd91c26ef11896a86471519d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
1.3MB

MD5
273b8bb8a29b24de7e664189e707b1e6

SHA1
18fbc8e40924df9a49b590acf419b26109415301

SHA256
a14c7fdc2ff52e679352176579b7cea8b94352b70b0cec51cba0d05881c10c2e

SHA512
d1976d37395728b6649e4a4d90bfe5a33b3dfafd36ff31ea6c77b5e513f667baa4d43d93465dc006ecca19e8639967974d5a7cc80127b5ca01112510b0b5a498

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
1.3MB

MD5
273b8bb8a29b24de7e664189e707b1e6

SHA1
18fbc8e40924df9a49b590acf419b26109415301

SHA256
a14c7fdc2ff52e679352176579b7cea8b94352b70b0cec51cba0d05881c10c2e

SHA512
d1976d37395728b6649e4a4d90bfe5a33b3dfafd36ff31ea6c77b5e513f667baa4d43d93465dc006ecca19e8639967974d5a7cc80127b5ca01112510b0b5a498

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
1.3MB

MD5
273b8bb8a29b24de7e664189e707b1e6

SHA1
18fbc8e40924df9a49b590acf419b26109415301

SHA256
a14c7fdc2ff52e679352176579b7cea8b94352b70b0cec51cba0d05881c10c2e

SHA512
d1976d37395728b6649e4a4d90bfe5a33b3dfafd36ff31ea6c77b5e513f667baa4d43d93465dc006ecca19e8639967974d5a7cc80127b5ca01112510b0b5a498

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
1.3MB

MD5
273b8bb8a29b24de7e664189e707b1e6

SHA1
18fbc8e40924df9a49b590acf419b26109415301

SHA256
a14c7fdc2ff52e679352176579b7cea8b94352b70b0cec51cba0d05881c10c2e

SHA512
d1976d37395728b6649e4a4d90bfe5a33b3dfafd36ff31ea6c77b5e513f667baa4d43d93465dc006ecca19e8639967974d5a7cc80127b5ca01112510b0b5a498

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\installer.exe

Filesize
1.3MB

MD5
273b8bb8a29b24de7e664189e707b1e6

SHA1
18fbc8e40924df9a49b590acf419b26109415301

SHA256
a14c7fdc2ff52e679352176579b7cea8b94352b70b0cec51cba0d05881c10c2e

SHA512
d1976d37395728b6649e4a4d90bfe5a33b3dfafd36ff31ea6c77b5e513f667baa4d43d93465dc006ecca19e8639967974d5a7cc80127b5ca01112510b0b5a498

Download Submit
memory/2000-54-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download
memory/2000-56-0x0000000000020000-0x000000000003F000-memory.dmp

Filesize
124KB

Download
memory/2000-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2000-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2000-65-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download