7e6476bb903bec80f258e48145b80c392251359d3d0780118a043f48bc2bde5e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 14:41

Target

c39ed68da37f6762e4368c4e9226e1f7.exe
Size

100KB
MD5

c39ed68da37f6762e4368c4e9226e1f7
SHA1

955079ba0ceb9da62b666c9f86ea2c5db40cf784
SHA256

7e6476bb903bec80f258e48145b80c392251359d3d0780118a043f48bc2bde5e
SHA512

a12675226c35ff3ed47f713aea7fd3005e43ba95a135a39b8f0fbe95da02b8a686301c41a625cd30f82c8f6e6f4594bfbb158c22d3286b858d7ac303aa1a642b
SSDEEP

3072:sGZHl1Cr3bSsHEIxLzkk3greqzSbXm8jbxDhh81:pZF1Cr3bSsHEIxL5g1eLmIdf8

Score

7^/10

upx

Deletes itself 1 IoCs

pid	Process
2916	cmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/2248-2-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2248-4-0x0000000000400000-0x000000000042A000-memory.dmp	upx
behavioral1/memory/2248-6-0x0000000000400000-0x000000000042A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2248	c39ed68da37f6762e4368c4e9226e1f7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2916	2248	c39ed68da37f6762e4368c4e9226e1f7.exe	28
PID 2248 wrote to memory of 2916	2248	c39ed68da37f6762e4368c4e9226e1f7.exe	28
PID 2248 wrote to memory of 2916	2248	c39ed68da37f6762e4368c4e9226e1f7.exe	28
PID 2248 wrote to memory of 2916	2248	c39ed68da37f6762e4368c4e9226e1f7.exe	28

C:\Users\Admin\AppData\Local\Temp\c39ed68da37f6762e4368c4e9226e1f7.exe
"C:\Users\Admin\AppData\Local\Temp\c39ed68da37f6762e4368c4e9226e1f7.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Rgf..bat" > nul 2> nul
  2⤵
  - Deletes itself
  PID:2916

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Rgf..bat

Filesize
210B

MD5
8de9b9a0e0775cd8b40808d4c0a854e1

SHA1
13f8052765a90947c96ac5778636b35b903a94a6

SHA256
2ec4bb31d027f0f21c51054cb35ae6be8c2705a8907f052702e4b433dea3c213

SHA512
4ef0f3739363967027ab48a7db92a5b931dfb921a2f4677d4235d9cf81706ccf40b4051510babbee18154f09e15991ae81afadfd2e284498fbf29a69ce587a27

Download Submit
memory/2248-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2248-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2248-1-0x00000000003A0000-0x00000000003A3000-memory.dmp

Filesize
12KB

Download
memory/2248-4-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/2248-3-0x00000000003C0000-0x00000000003C2000-memory.dmp

Filesize
8KB

Download
memory/2248-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download