c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55

Analysis

max time kernel
58s
max time network
57s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55.exe
Size

123KB
MD5

5fc968d40c3dcdbe18fa9a55ddbc3328
SHA1

b4869224536f56bcaa690f5ec3947696924a7033
SHA256

c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55
SHA512

2c913dbde855080f066ff08562f5d72fe2dccc1879ed30cb5f6ce05a6ae6dda011eb240ee170890f9be346a0c3ba4e23f4705a661850eb118878acf1692599ff
SSDEEP

1536:MpeSewu82rcrVtrWbzDbEgf1NQdEa3dqBfIe5EyzIcAqyG3/kvQxDvW8d6eGJveF:WeH+UbEU1NwEa3d34fS84eXBVvDRCT

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1252-55-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1112	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 1112	1252	c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55.exe	28
PID 1252 wrote to memory of 1112	1252	c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55.exe	28
PID 1252 wrote to memory of 1112	1252	c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55.exe	28
PID 1252 wrote to memory of 1112	1252	c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55.exe	28

C:\Users\Admin\AppData\Local\Temp\c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55.exe
"C:\Users\Admin\AppData\Local\Temp\c18ad80f36cb366b3193c2347b83ef03685ae2c32b054446e3db7df26d252f55.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Tjp..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tjp..bat

Filesize
274B

MD5
97dc8e5d51958ec4b61c39d354cee64d

SHA1
d1841a43caed3953dafc81101d3ceedcb49e3817

SHA256
738412231b83440f924a533f46ca0e1fae959fd742c2c87ab25aba019a41ccc7

SHA512
25a360ca62da3ecace0ebe9883138fe70d6a81f758ae287e36703cd858779cde453e74aa558cef9aa79cd4d5b9a778246fc4cb5f33d3578b4228d505bef84077

Download Submit
memory/1252-54-0x0000000075991000-0x0000000075993000-memory.dmp

Filesize
8KB

Download
memory/1252-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1252-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1252-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1252-59-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download