bcfd60fb4a5fef183a377bd4e7da427122ad2c7e3318f09d332a58e18c1886d4

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 00:00

Target

3e345c6d77cdd3a3a0d96b954b92f475.exe
Size

158KB
MD5

3e345c6d77cdd3a3a0d96b954b92f475
SHA1

dbb7bdc921659f55238aea786d833a025c381f7f
SHA256

bcfd60fb4a5fef183a377bd4e7da427122ad2c7e3318f09d332a58e18c1886d4
SHA512

88e2115f77a12f4c66ea47870dcc8b4d19f6f5ec21f68276b64cdd5a170961ae36fdcfb2accb56dc4ee495d39153b7560e9d9e607a60d9dff71d8b494ca9c46b
SSDEEP

1536:lNAMrUUxCuq22G0qaODOjBjfXZOCQLz7YX:LJwjODKZgL

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2744	cmd.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2152-2-0x0000000000400000-0x0000000000483000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2152	3e345c6d77cdd3a3a0d96b954b92f475.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2744	2152	3e345c6d77cdd3a3a0d96b954b92f475.exe	28
PID 2152 wrote to memory of 2744	2152	3e345c6d77cdd3a3a0d96b954b92f475.exe	28
PID 2152 wrote to memory of 2744	2152	3e345c6d77cdd3a3a0d96b954b92f475.exe	28
PID 2152 wrote to memory of 2744	2152	3e345c6d77cdd3a3a0d96b954b92f475.exe	28

C:\Users\Admin\AppData\Local\Temp\3e345c6d77cdd3a3a0d96b954b92f475.exe
"C:\Users\Admin\AppData\Local\Temp\3e345c6d77cdd3a3a0d96b954b92f475.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2744

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\a..bat

Filesize
210B

MD5
7782bcf31ae387e28a5dbc013dd50903

SHA1
3be509e308c44eb1258784eb4b30d44c5e3bd096

SHA256
7f03f7fd8d591acebe37cd970f92916ecb8b3c9b97813f031f88e0b51aa86849

SHA512
fed478ae94e7f3eb13e37a19150f4cbb235e272327880949926869fd25250dd43141e94fe2ee146ececb430346a028098ad157a5615631f516e5a8e1fd336f20

Download Submit
memory/2152-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/2152-2-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download