b2ad43f9bae4e0ee1388ec749c10465949a0b7da4dfda8ae909818c6b99d465f

Analysis

max time kernel
151s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 01:50

Target

b2ad43f9bae4e0ee1388ec749c10465949a0b7da4dfda8ae909818c6b99d465f.exe
Size

62KB
MD5

f2e9f11d7c3e76af0a432a445b1ec105
SHA1

36e06d5303706e3c261f9aa21a683b71d27daa3c
SHA256

b2ad43f9bae4e0ee1388ec749c10465949a0b7da4dfda8ae909818c6b99d465f
SHA512

a74be00208c475fce669913468051245238cbd42fb5792ca12a7fb3628252e209c526d5bb2749a509563e0a424912a8993cc5e6b485ed7a925619d2a785ab8d2
SSDEEP

1536:NRTjlxNx9aGdvt1nv1y7HaPr0+ltFtfZCFfxo0Bk:NRTHIM9vM2PrRXHBUDBk

Score

8^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/900-55-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/900-56-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
900	b2ad43f9bae4e0ee1388ec749c10465949a0b7da4dfda8ae909818c6b99d465f.exe

C:\Users\Admin\AppData\Local\Temp\b2ad43f9bae4e0ee1388ec749c10465949a0b7da4dfda8ae909818c6b99d465f.exe
"C:\Users\Admin\AppData\Local\Temp\b2ad43f9bae4e0ee1388ec749c10465949a0b7da4dfda8ae909818c6b99d465f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:900

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/900-54-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/900-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/900-56-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download