c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94

Analysis

max time kernel
53s
max time network
55s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
28-03-2023 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe
Size

277KB
MD5

5a1a0817f7f1db2e270219ab9905b90d
SHA1

8597a4de3d78c27a61f70044872b8fad9ed6acf0
SHA256

c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94
SHA512

8b2952e968a1ee0ce49814bd4570c0c25bd5b61d0170322cad39e5a70b9cc2b50cfb4ca413f9b739044eb6e8ad599efa599a8df927f37338791a509b329391b2
SSDEEP

6144:+XzKdNY49u8rVj5hV7k1QXzF5OS01netx:Fa4A85/7lXiS01a

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

ITS SB App Switch.exeITS SB App Switch.exe

pid process

1228 ITS SB App Switch.exe
1344 ITS SB App Switch.exe

pid	process
1228	ITS SB App Switch.exe
1344	ITS SB App Switch.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1012-121-0x00000000012E0000-0x0000000001380000-memory.dmp	upx
behavioral1/memory/1012-129-0x00000000012E0000-0x0000000001380000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe

pid	process
1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe
1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe
1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe
1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe

description	pid	process	target process
PID 1012 wrote to memory of 1228	1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe	ITS SB App Switch.exe
PID 1012 wrote to memory of 1228	1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe	ITS SB App Switch.exe
PID 1012 wrote to memory of 1228	1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe	ITS SB App Switch.exe
PID 1012 wrote to memory of 1344	1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe	ITS SB App Switch.exe
PID 1012 wrote to memory of 1344	1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe	ITS SB App Switch.exe
PID 1012 wrote to memory of 1344	1012	c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe	ITS SB App Switch.exe

C:\Users\Admin\AppData\Local\Temp\c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe
"C:\Users\Admin\AppData\Local\Temp\c9f6eeccf5c0f017baf86f0861b0cad9d5b7e153e932668d7d09b2cefb395a94.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1012

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
2⤵
- Executes dropped EXE
PID:1228

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
2⤵
- Executes dropped EXE
PID:1344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
Filesize
87KB

MD5
368332fca74f48697d842c5f4698ae1d

SHA1
0275153a1e62bd0eca0b02168895517ed66aac56

SHA256
3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

SHA512
fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

Download Submit
memory/1012-121-0x00000000012E0000-0x0000000001380000-memory.dmp

Filesize
640KB

Download
memory/1012-129-0x00000000012E0000-0x0000000001380000-memory.dmp

Filesize
640KB

Download