a2e6ca2b3688aa3fdce1be0d75c20c7ee1b61d5df66d258303bc5ef05a2f42b5

Analysis

max time kernel
20s
max time network
2s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2e6ca2b3688aa3fdce1be0d75c20c7ee1b61d5df66d258303bc5ef05a2f42b5.exe
Size

267KB
MD5

15b67767112d63d4434e0780ce6705bd
SHA1

b6b13568a016806222a489d08f467f5dd031694b
SHA256

a2e6ca2b3688aa3fdce1be0d75c20c7ee1b61d5df66d258303bc5ef05a2f42b5
SHA512

dd8b324cd4f2f6dd2037cf345afe4010386ce26e0f227777edfa82baa8cc9b395695be5c3224d3867d68566fc54a27d357cf181bc3938eb711d5eb80b6f874ee
SSDEEP

6144:+IoJK5jP9nFxDmodkqqNLWM3FW9pAWlYN5y5U/p1zAHop:+tGxDJNYWpAvcUx19

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1404-132-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/1404-133-0x0000000000400000-0x00000000004AE000-memory.dmp	upx
behavioral2/memory/1404-134-0x0000000000400000-0x00000000004AE000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1404-133-0x0000000000400000-0x00000000004AE000-memory.dmp	autoit_exe
behavioral2/memory/1404-134-0x0000000000400000-0x00000000004AE000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\a2e6ca2b3688aa3fdce1be0d75c20c7ee1b61d5df66d258303bc5ef05a2f42b5.exe
"C:\Users\Admin\AppData\Local\Temp\a2e6ca2b3688aa3fdce1be0d75c20c7ee1b61d5df66d258303bc5ef05a2f42b5.exe"
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1404-132-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1404-133-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download
memory/1404-134-0x0000000000400000-0x00000000004AE000-memory.dmp

Filesize
696KB

Download