bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521

Analysis

max time kernel
153s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Size

9KB
MD5

8d169258215f1e437adb4c5313db01fa
SHA1

820f910e55dc602cb917c5372c66ca3cf1468c07
SHA256

bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521
SHA512

091769cc1a8232b0bd7fa0a8c8a704f2a14e08a7ec477d1d1c09cc100f9b456141d6295c05afb6ffe5f2d316f32e8e0825aba634928d883d5d8650bcfbd5f4dc
SSDEEP

96:ywjv5gdMoSl5wnNgOxrGal1VyEbWgOYKnWTBvo8duz+Kp6MJqIkXQK1xPCuEW7OA:/cModNhbTqgqWTvdlKpbJRkLaTFfzYP

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/744-132-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/744-133-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/720-134-0x0000000000400000-0x0000000000409000-memory.dmp	upx

Modifies registry class 8 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}\Data\ = 000000000a580f0400000000000000000000000000000000	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}\LocalServer32	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe"	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}\LocalServer32	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe"	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9D990AD3-C376-13C1-F0CD-261DF74058DF}\Data	bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe

C:\Users\Admin\AppData\Local\Temp\bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
"C:\Users\Admin\AppData\Local\Temp\bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe"
1⤵
- Modifies registry class
PID:744

C:\Users\Admin\AppData\Local\Temp\bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe
"C:\Users\Admin\AppData\Local\Temp\bd0cf8571ce764206dd9685450b366eea961d96ccd1b21fd0e3c86332dd3d521.exe" /s
1⤵
- Modifies registry class
PID:720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/720-134-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/744-132-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/744-133-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads