e0878b0d3455a1437ec5f9b7f6cace1051bafe16e518d6aac38dba1e5ce6d785

Analysis

max time kernel
35s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0878b0d3455a1437ec5f9b7f6cace1051bafe16e518d6aac38dba1e5ce6d785.exe
Size

303KB
MD5

d94b7959dbd95ee865f337a86fedd8b6
SHA1

05a442a865574bf4988da97d7039f96b3d24aff2
SHA256

e0878b0d3455a1437ec5f9b7f6cace1051bafe16e518d6aac38dba1e5ce6d785
SHA512

99e8d8f80d5e318581d05c3959cdc8bacf53346ef88737dea8017a5f0998bf809674b901299d16692c1800815e19bfbc5bb081cf581c965b638304d22b174ec7
SSDEEP

6144:wjn325g9LcO04S629EzDTZvxVK9tp4S9xn23/wjKsR:wj3229A5629EzXZvx89tWS9UIu0

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-55-0x0000000000400000-0x00000000004BF000-memory.dmp	upx
behavioral1/memory/1992-56-0x0000000000400000-0x00000000004BF000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1992-55-0x0000000000400000-0x00000000004BF000-memory.dmp	autoit_exe
behavioral1/memory/1992-56-0x0000000000400000-0x00000000004BF000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\e0878b0d3455a1437ec5f9b7f6cace1051bafe16e518d6aac38dba1e5ce6d785.exe
"C:\Users\Admin\AppData\Local\Temp\e0878b0d3455a1437ec5f9b7f6cace1051bafe16e518d6aac38dba1e5ce6d785.exe"
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1992-56-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download