a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 22:11

Target

a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
Size

70KB
MD5

0c7d0eea222f3c34f72be07e141f7f5a
SHA1

cf6d546c9cea2306f2d9e95c2767e4c3df8417a5
SHA256

a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78
SHA512

5b7f18fe17f5bdf4cbf7c808a252bf0f24c46777037c0df64c62c35135b04df3ef19a9a51c1526432fe3562d0f0f8183f85aecf3878e9cbc89031b0a542bc04e
SSDEEP

1536:Qc+E19oIzg3CJuL0gZEQ5w7x3kWM0erCdqeFPF4oEF6mQ8q:RzjoIzg3Ci6uW3l8rCf78q

Score

8^/10

evasion upx

Executes dropped EXE 1 IoCs

pid	Process
3676	msnmsgr.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/5024-132-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/files/0x0003000000022e05-139.dat	upx
behavioral2/files/0x0003000000022e05-138.dat	upx
behavioral2/memory/3676-142-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral2/memory/5024-143-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\msnmsgr.exe	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
File opened for modification	C:\Windows\msnmsgr.exe	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3092	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
3676	msnmsgr.exe
3676	msnmsgr.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
Token: SeSystemtimePrivilege	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
Token: SeSystemtimePrivilege	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
Token: SeSystemtimePrivilege	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
3676	msnmsgr.exe
3676	msnmsgr.exe
3676	msnmsgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 3092	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe	84
PID 5024 wrote to memory of 3092	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe	84
PID 5024 wrote to memory of 3092	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe	84
PID 5024 wrote to memory of 3676	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe	85
PID 5024 wrote to memory of 3676	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe	85
PID 5024 wrote to memory of 3676	5024	a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe	85

C:\Users\Admin\AppData\Local\Temp\a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe
"C:\Users\Admin\AppData\Local\Temp\a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\21reg.reg
  2⤵
  - Runs .reg file with regedit
  PID:3092
- C:\Windows\msnmsgr.exe
  C:\Windows\msnmsgr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3676

C:\21reg.reg

Filesize
121B

MD5
8c0c2a3561f09e9da4f663ebd9db06dc

SHA1
060cfdaa3aa592ec1bede0c4e71a6da3baf42dd4

SHA256
4c3f8b2bae6bd3dec43219df3845068964d4a2e398bc20a32e75d7379d0a1c03

SHA512
b45639591a3ad789831d6b45dd5e7e5cee5e8206f3fa225e39032e1f64d4dd3e74cd367444d615fa89259176e28cfeaa03106c87e12c45d4d5e4c9975b4a8ec8

Download Submit
C:\Windows\msnmsgr.exe

Filesize
70KB

MD5
0c7d0eea222f3c34f72be07e141f7f5a

SHA1
cf6d546c9cea2306f2d9e95c2767e4c3df8417a5

SHA256
a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78

SHA512
5b7f18fe17f5bdf4cbf7c808a252bf0f24c46777037c0df64c62c35135b04df3ef19a9a51c1526432fe3562d0f0f8183f85aecf3878e9cbc89031b0a542bc04e

Download Submit
C:\Windows\msnmsgr.exe

Filesize
70KB

MD5
0c7d0eea222f3c34f72be07e141f7f5a

SHA1
cf6d546c9cea2306f2d9e95c2767e4c3df8417a5

SHA256
a91ae5e56784ff7d7e34dda003e7e009f79c6cbeee988cbe92bf008a565d7c78

SHA512
5b7f18fe17f5bdf4cbf7c808a252bf0f24c46777037c0df64c62c35135b04df3ef19a9a51c1526432fe3562d0f0f8183f85aecf3878e9cbc89031b0a542bc04e

Download Submit
memory/3676-142-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5024-132-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/5024-143-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download