cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232

Analysis

max time kernel
182s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe
Size

1.4MB
MD5

d0d9861f967032e5328a5e47a115b505
SHA1

686221245446ed6a53c8f0975447cb65b958cee2
SHA256

cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232
SHA512

ecc735a5095cbaa86d7c98877b0334e4e81f8928e5346f4d90f1aeaac8ad1777b0ae399af7af1bbdddc74ada3fb62410db0adda2f261b7df25f0f30d023efc22
SSDEEP

24576:JYcFMJLhVPZByLCMNprvSbDIGa+ru34txIzvqgfN2T7gHMfLVo22YmjJEJWp2kVk:JYvjPiLCMN9SDVayOmy24sfZo22YOOW8

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4264-133-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4264-133-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4264 set thread context of 5032	4264	cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5112	5032	WerFault.exe	79

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 5032	4264	cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe	79
PID 4264 wrote to memory of 5032	4264	cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe	79
PID 4264 wrote to memory of 5032	4264	cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe	79

C:\Users\Admin\AppData\Local\Temp\cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe
"C:\Users\Admin\AppData\Local\Temp\cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Users\Admin\AppData\Local\Temp\cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe
  "C:\Users\Admin\AppData\Local\Temp\cc2c4f19c1fcd18f81042c5d3bd0c6e3ba4f270d56b1decadbb2818702f2f232.exe"
  2⤵
  PID:5032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 12
    3⤵
    - Program crash
    PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5032 -ip 5032
1⤵
PID:4296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4264-133-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download