bcf7e33a1edbc1625eb9d6b5d96aa3c1dc2ca12b1114ea365d84c562bc62309b

Analysis

max time kernel
10s
max time network
134s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 14:36

Target

3ecc7ead7292780c4b982276f3605533.exe
Size

158KB
MD5

3ecc7ead7292780c4b982276f3605533
SHA1

02bc1f1ec71b76a6fbc3a967eee2f5ba28c6b3eb
SHA256

bcf7e33a1edbc1625eb9d6b5d96aa3c1dc2ca12b1114ea365d84c562bc62309b
SHA512

3f6c0cbb7764e4159dee8aa4f3fb0395494356bd1b542bec15236827cd10dfac4854b605d513a01dba8fa259ac4b207e844893adec7d978674afc75471c0b288
SSDEEP

1536:lBAMrUUxCuq22G0qaODOjBjfXZOCQLz7YX:fJwjODKZgL

Score

7^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1916-2-0x0000000000400000-0x0000000000483000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1916	3ecc7ead7292780c4b982276f3605533.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2432	1916	3ecc7ead7292780c4b982276f3605533.exe	28
PID 1916 wrote to memory of 2432	1916	3ecc7ead7292780c4b982276f3605533.exe	28
PID 1916 wrote to memory of 2432	1916	3ecc7ead7292780c4b982276f3605533.exe	28
PID 1916 wrote to memory of 2432	1916	3ecc7ead7292780c4b982276f3605533.exe	28

C:\Users\Admin\AppData\Local\Temp\3ecc7ead7292780c4b982276f3605533.exe
"C:\Users\Admin\AppData\Local\Temp\3ecc7ead7292780c4b982276f3605533.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\a..bat" > nul 2> nul
  2⤵
  PID:2432

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1916-0-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/1916-2-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download