36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-04-2023 09:30

Sharing

Copy URL

Twitter E-mail

Reason

Reading agent response: read tcp 10.127.0.1:45754->10.127.0.33:8000: read: connection reset by peer

Report Analysis Logs

General

Target

36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe
Size

4.2MB
MD5

32de66a467db22cf0f5b65d1a9f4e19c
SHA1

cdb5c200cba7da3f6e80e868ef7df380ac1259c2
SHA256

36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4
SHA512

af200cc334c05e5fe0df1d4c76b5ce469d034c0d62288d207b6bb6562579e07dc4510e4bfc4b726cf1a9f82ae8cb69c4630e981f23d05fb85e3be842a34244f1
SSDEEP

49152:fgZNPqLGVfMmq1d1MRGM8Fvg9fR5HMXF9W9HrAbluBUMNk+cqG2UtBpStPvC/9f+:fgXsMfql+9G9+B+tBpEPvCF

Score

9^/10

evasion ransomware upx

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1584	bcdedit.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-54-0x0000000000400000-0x000000000082C000-memory.dmp	upx

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1584	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	29
PID 1736 wrote to memory of 1584	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	29
PID 1736 wrote to memory of 1584	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	29
PID 1736 wrote to memory of 1584	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	29
PID 1736 wrote to memory of 1712	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	30
PID 1736 wrote to memory of 1712	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	30
PID 1736 wrote to memory of 1712	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	30
PID 1736 wrote to memory of 1712	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	30
PID 1736 wrote to memory of 884	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	31
PID 1736 wrote to memory of 884	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	31
PID 1736 wrote to memory of 884	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	31
PID 1736 wrote to memory of 884	1736	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	31

C:\Users\Admin\AppData\Local\Temp\36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe
"C:\Users\Admin\AppData\Local\Temp\36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1736
- \??\c:\windows\system32\bcdedit.exe
  c:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1584
- C:\Windows\SysWOW64\shutdown.exe
  shutdown /r /f /t 00
  2⤵
  PID:1712
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\SysWOW64\shutdown.exe /r /f /t 00
  2⤵
  PID:884
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\System32\shutdown.exe /r /f /t 00
  2⤵
  PID:432
- \??\c:\windows\system32\shutdown.exe
  c:\windows\Sysnative\shutdown.exe /r /f /t 00
  2⤵
  PID:1912

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact