3c908b576e0ddadb5c94122e8f11b6701201518fa99e6cc33f69f17168da6d88

Analysis

max time kernel
146s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/09/2022, 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c908b.exe
Size

1.8MB
MD5

e42258346c952cdf44c934daadf6a5be
SHA1

9382cd1b2986cb98a6f88998b8c824925569e6ca
SHA256

3c908b576e0ddadb5c94122e8f11b6701201518fa99e6cc33f69f17168da6d88
SHA512

d9d90e8f58d8a7ae6bbff090291cee913eac3d4a7497df79410db1155ce993cdebe484f5847dceb9bdd044ed48a97141810932d6ab4d846e9dfa51f9a6e300ff
SSDEEP

49152:ZDmghls3y1+XfWL6Vcp5/SOQZczixVST2x8GEtqvgtUn:Zmghls5Bq/HX2IT2jEtqvg

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1980-54-0x0000000000C30000-0x000000000119B000-memory.dmp	upx
behavioral1/memory/1980-55-0x0000000000C30000-0x000000000119B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	3c908b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Administrator = "C:\\ProgramData\\Microsoft\\csrss.exe"	3c908b.exe

C:\Users\Admin\AppData\Local\Temp\3c908b.exe
"C:\Users\Admin\AppData\Local\Temp\3c908b.exe"
1⤵
- Adds Run key to start application
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-54-0x0000000000C30000-0x000000000119B000-memory.dmp

Filesize
5.4MB

Download
memory/1980-55-0x0000000000C30000-0x000000000119B000-memory.dmp

Filesize
5.4MB

Download