aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db

Analysis

max time kernel
173s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 05:36

Target

aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
Size

609KB
MD5

4e23149ed324a779f5c9d5c869046d7f
SHA1

5b5383bfe496b431c0180830661d0d15ec0453cf
SHA256

aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db
SHA512

a6f7bac55fd111fbd1532f3e48aa3f2e04d47a24b0ac8a8764eaffbd38216a47d4453215c078d8f94a10675fac9a74da2659c5fb14374c1d8c16091c63fb4d0b
SSDEEP

12288:7vpNGlg+kXH76+g7SxzsnSjfAPRfYg9WxXqnkNu0cNRe/4cT/HjPSABwQW:7vWu+MRVxzOSLCNYAWxXq2mReZ/Hw

Score

8^/10

upx

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/216-132-0x0000000002260000-0x0000000002393000-memory.dmp	upx
behavioral2/memory/216-135-0x0000000002260000-0x0000000002393000-memory.dmp	upx
behavioral2/memory/216-136-0x0000000002260000-0x0000000002393000-memory.dmp	upx
behavioral2/memory/216-139-0x0000000002260000-0x0000000002393000-memory.dmp	upx
behavioral2/memory/4248-141-0x0000000002180000-0x00000000022B3000-memory.dmp	upx
behavioral2/memory/4248-145-0x0000000002180000-0x00000000022B3000-memory.dmp	upx
behavioral2/memory/4248-144-0x0000000002180000-0x00000000022B3000-memory.dmp	upx
behavioral2/memory/216-146-0x0000000002260000-0x0000000002393000-memory.dmp	upx
behavioral2/memory/4248-148-0x0000000002180000-0x00000000022B3000-memory.dmp	upx
behavioral2/memory/4248-149-0x0000000002180000-0x00000000022B3000-memory.dmp	upx
behavioral2/memory/4248-150-0x0000000002180000-0x00000000022B3000-memory.dmp	upx
behavioral2/memory/4248-151-0x0000000002180000-0x00000000022B3000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
Token: SeCreatePagefilePrivilege	216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4248	216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe	84
PID 216 wrote to memory of 4248	216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe	84
PID 216 wrote to memory of 4248	216	aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe	84

C:\Users\Admin\AppData\Local\Temp\aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
"C:\Users\Admin\AppData\Local\Temp\aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216
- C:\Users\Admin\AppData\Local\Temp\aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe
  "C:\Users\Admin\AppData\Local\Temp\aff9d576d03bd2d1dfe67da733fa05a7c997521e5f314f76e7d6b0d05e5ee2db.exe" /_ShowProgress
  2⤵
  PID:4248

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/216-132-0x0000000002260000-0x0000000002393000-memory.dmp

Filesize
1.2MB

Download
memory/216-135-0x0000000002260000-0x0000000002393000-memory.dmp

Filesize
1.2MB

Download
memory/216-136-0x0000000002260000-0x0000000002393000-memory.dmp

Filesize
1.2MB

Download
memory/216-137-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/216-138-0x00000000021C0000-0x0000000002259000-memory.dmp

Filesize
612KB

Download
memory/216-139-0x0000000002260000-0x0000000002393000-memory.dmp

Filesize
1.2MB

Download
memory/216-146-0x0000000002260000-0x0000000002393000-memory.dmp

Filesize
1.2MB

Download
memory/4248-145-0x0000000002180000-0x00000000022B3000-memory.dmp

Filesize
1.2MB

Download
memory/4248-141-0x0000000002180000-0x00000000022B3000-memory.dmp

Filesize
1.2MB

Download
memory/4248-144-0x0000000002180000-0x00000000022B3000-memory.dmp

Filesize
1.2MB

Download
memory/4248-147-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4248-148-0x0000000002180000-0x00000000022B3000-memory.dmp

Filesize
1.2MB

Download
memory/4248-149-0x0000000002180000-0x00000000022B3000-memory.dmp

Filesize
1.2MB

Download
memory/4248-150-0x0000000002180000-0x00000000022B3000-memory.dmp

Filesize
1.2MB

Download
memory/4248-151-0x0000000002180000-0x00000000022B3000-memory.dmp

Filesize
1.2MB

Download