f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6

Analysis

max time kernel
52s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-12-2022 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6.exe
Size

633KB
MD5

1894979035c3f3c277d56af60634f27a
SHA1

b79244e6b3409850ae13fe2a436cab5cb13ae300
SHA256

f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6
SHA512

18a28c8f5e5c4eddabcf61b8baaca00eb076a2188eaf41e110198a4b05464a181c7f954461b81e1a4cc4fdbcf8a791b1c2ab3bddeaf20fdeefb4f6555191c06b
SSDEEP

12288:Dmz9D59BmQ6oK4Irm/OtKafiiEdabltpVCkxOJMSYlCc6QcRLh9NZU0j:Kz9D590Rogrm/OB4UltngMTgDQcRLP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2032-55-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2032-57-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
752	DllHost.exe

C:\Users\Admin\AppData\Local\Temp\f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6.exe
"C:\Users\Admin\AppData\Local\Temp\f8d3b82d27741acda1db3cb2419311ac5abe5c9c07b49098e5cd73ae0a367ba6.exe"
1⤵
PID:2032

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WWW.THEGENIUS.TV - UP.BY-ERIVANILDO (6).jpg

Filesize
513KB

MD5
dcb875421ca5e058736c187d4593ea56

SHA1
520c4710beca8f9374760e9e521bd48c8445b764

SHA256
e20ae9c2b213f5c5184035f9857b730cb374c234551541c6a7d0b4d6cb311655

SHA512
7ab84642149f54ccea9d163639c3ff702e1f9d4d4fc9068cdc4a27f2084b800a8c4b4ace841681c64f22e616101cdf27b6f19a184d45afb92b49cd1fa9f2a44d

Download Submit
memory/2032-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/2032-55-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2032-57-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download