Analysis

  • max time kernel
    19s
  • max time network
    70s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06-12-2022 15:59

General

  • Target

    e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe

  • Size

    164KB

  • MD5

    b7b381eb309c01d468d3a88d91870c7a

  • SHA1

    d43c553479b6929abc98a04db0022fc3091431b4

  • SHA256

    e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61

  • SHA512

    c00c02b72d558778cc8470e03bb8c738e87081be51c20237d7ab823f83eeec846bede1e20a954eefcd184cbe28748a85f2cc7c94dd928bebe06ccae3fad888f4

  • SSDEEP

    3072:2aJTm6MaNm+DhIy6rZhwOZNHja5NjAzc9gTCsDS56zfmw5hfDkK:2aIfal2y6rTNDarmc9wS56Cig

Score
10/10

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe
    "C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe
      "C:\Users\Admin\AppData\Local\Temp\e2eddf47a6f047307257f48c3288fe1d2a62a2b62a5113f9fc00bf33f94abe61.exe" Administrator
      2⤵
      • UAC bypass
      • Checks whether UAC is enabled
      • System policy modification
      PID:980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/884-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

    Filesize

    8KB

  • memory/884-55-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/884-57-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/980-56-0x0000000000000000-mapping.dmp

  • memory/980-59-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

  • memory/980-60-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB