65a588cb192668254d8f6231bdf9f45fbfe342d34f234236687864e1db668cef

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 04:30

Target

283a8d8108d3a8dc8b2020864e359f51.exe
Size

379KB
MD5

283a8d8108d3a8dc8b2020864e359f51
SHA1

cfd32af4450fb63b9e66fbbedcab93637fc3900c
SHA256

65a588cb192668254d8f6231bdf9f45fbfe342d34f234236687864e1db668cef
SHA512

464fc3c7fb1cdc7e8627921ba42e2ee2f08f122d6a2d3e002ec4ebd6af56c69234a8108d689d8ef67153404e967081420611127b0cb03082b1984850ddf875fb
SSDEEP

6144:DrDJa7rspPBcndOjm+qzLzIke3cssoofBT+ArtkQ77QTveZAS16OWxfuZ3:nDJaOBAj+qLD5lBVttIv+AUJZ3

Score

7^/10

upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2732-0-0x0000000000400000-0x0000000000566000-memory.dmp	upx
behavioral1/memory/2732-1-0x0000000000400000-0x0000000000566000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2732	283a8d8108d3a8dc8b2020864e359f51.exe

C:\Users\Admin\AppData\Local\Temp\283a8d8108d3a8dc8b2020864e359f51.exe
"C:\Users\Admin\AppData\Local\Temp\283a8d8108d3a8dc8b2020864e359f51.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2732

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2732-0-0x0000000000400000-0x0000000000566000-memory.dmp

Filesize
1.4MB

Download
memory/2732-1-0x0000000000400000-0x0000000000566000-memory.dmp

Filesize
1.4MB

Download