5510bd4c938bed5c4ee3a27948406a98f51be9bd55b6b6c9306e24c8bb0155c8

Analysis

max time kernel
36s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/02/2023, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5510bd4c938bed5c4ee3a27948406a98f51be9bd55b6b6c9306e24c8bb0155c8.exe
Size

11.0MB
MD5

00e701f3cc6eaada6909a651047ebdd8
SHA1

72d5de72a7020447ad90e8fbc2e5028f668f89ac
SHA256

5510bd4c938bed5c4ee3a27948406a98f51be9bd55b6b6c9306e24c8bb0155c8
SHA512

a4355a81b0c9ac5627a75bf2b6cde3061ed3d4f4edc2004b3c4f768fffe85e9a65e71614a68376e8eecffecada8cd4c66ef7e6aaf9e0dd5a2b36cbdd73da1eae
SSDEEP

196608:skncn063UJxfbqJX0I/f+DY0hBY+gADvsV/xr+uD0miCjt8O9nrkH:nncn06q2JEI/fMY0LvsV/xhXB9nIH

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1956-55-0x0000000000400000-0x0000000000581000-memory.dmp	upx
behavioral1/memory/1956-56-0x0000000000400000-0x0000000000581000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\5510bd4c938bed5c4ee3a27948406a98f51be9bd55b6b6c9306e24c8bb0155c8.exe
"C:\Users\Admin\AppData\Local\Temp\5510bd4c938bed5c4ee3a27948406a98f51be9bd55b6b6c9306e24c8bb0155c8.exe"
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1956-55-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download
memory/1956-56-0x0000000000400000-0x0000000000581000-memory.dmp

Filesize
1.5MB

Download