28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4

Analysis

max time kernel
41s
max time network
52s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4.exe
Size

84KB
MD5

516f8a7d525d895662582f22d98cc7e6
SHA1

4046b2f36127f6d6ab9135ecbd4e2f25666a649c
SHA256

28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4
SHA512

6a2949c301612525f0767971164c129e30dd828d62aac21acdd67b54196e73dcae30c0be56820cc21a3175807524f45bb9842939da28f44dea5682ae98af44fd
SSDEEP

1536:uWQMTtHSH2e3Q/dGhDsuKutMZ1tTheL9sbcXDXubdNbCOc157cEh5TwlhW6kPRFT:fBtDdjzu2tq+EebdNeOcAUNwlKJxj

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1168-55-0x0000000000400000-0x0000000000431000-memory.dmp	upx
behavioral1/memory/1168-56-0x0000000000400000-0x0000000000431000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSFox = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4.exe"	28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4.exe

C:\Users\Admin\AppData\Local\Temp\28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4.exe
"C:\Users\Admin\AppData\Local\Temp\28e4d8aa371bcbc108bc8abec4055488142673746b1a3419b1b79632661415d4.exe"
1⤵
- Adds Run key to start application
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1168-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/1168-56-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download