e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf.exe
Size

27KB
MD5

9505fdccbf32ec1f9ffdd0f53f28a0ba
SHA1

067a2a75c3227167790f3a3883eb4ef4ee8125b8
SHA256

e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf
SHA512

6af03d486f15fef19812a02e8b0351ed8f526b832324a1c5ef5461c664540b1c9d52c2fea7729803acfd6baeae89fe1d47ce8bf0b978070f4aee8b86a5367cba
SSDEEP

768:7osL7jtE843PxHZwsv06GD/IhP+CNX8S31baiDn:rhr43PlZRGD/IhWCNX8SJv

Score

8^/10

upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hîsts	WScript.exe
File opened for modification	C:\Windows\system32\drivers\etc\hîsts	WScript.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1228-54-0x0000000000400000-0x0000000000414000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AdobeUpdater.lnk	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 992	1228	e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf.exe	27
PID 1228 wrote to memory of 992	1228	e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf.exe	27
PID 1228 wrote to memory of 992	1228	e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf.exe	27
PID 1228 wrote to memory of 992	1228	e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf.exe	27

C:\Users\Admin\AppData\Local\Temp\e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf.exe
"C:\Users\Admin\AppData\Local\Temp\e17c72b334f048deae2c9c2fbae47c123e5d7ea05b723f0f566f1f4ca87cccdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ex.vbs"
  2⤵
  - Drops file in Drivers directory
  - Drops startup file
  PID:992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ex.vbs

Filesize
911B

MD5
b49065b2e584432bef9a06ab430cb27b

SHA1
10290eba90ae147748b3857343572d495384f099

SHA256
45e78a6c3c983a500561b726112bce9eb63eae5eec104c6af1edc63a159a8c4f

SHA512
f4174d06c499ee3c32f342560c1c6b020b75782316f532992d1d870787610390f10929ad3126c4ecc64caff3d1b5156354a6ad9863ee90ec646ce67ce23c537d

Download Submit
C:\Users\Admin\AppData\Local\Temp\h2

Filesize
769B

MD5
45954f9078276becd94b3e723803279f

SHA1
48fe4b9e46f989e26263e420041f3a9d1a1dfeb7

SHA256
86ab20e8a8167fbb13f9fe5456fa9bd7d72315bb342c184d2f38b64aaef102d1

SHA512
a1df12ed9975dfe5ec3d1b2e337e8c13f954dd6497541d2b388764036ddfae84f3ab2634996da2ae0c697e8e7728db73a847064ac94575d4c203cde635ad23c5

Download Submit
memory/1228-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1228-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1228-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download