1c924e5c3639fd9af8263c985dad9d7fb41b4eb23133563362cff92f3b410f07

Analysis

max time kernel
27s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-03-2023 14:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0FF1C3 2021 - by Diekrolo/M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M/OInstall.exe
Size

10.9MB
MD5

ebc58647462ad9c76395ef451064d115
SHA1

14e470812f13b278b2694a4cec5737a39784e9dd
SHA256

414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
SHA512

8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
SSDEEP

196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1536-54-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1536-56-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/1536-60-0x0000000000400000-0x000000000199D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe
"C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe"
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1536-54-0x0000000000400000-0x000000000199D000-memory.dmp

Filesize
21.6MB

Download
memory/1536-56-0x0000000000400000-0x000000000199D000-memory.dmp

Filesize
21.6MB

Download
memory/1536-60-0x0000000000400000-0x000000000199D000-memory.dmp

Filesize
21.6MB

Download