27fed59e2e432f108a5d09fe93700b3f558aedebffb74f51e5119a79adb96dd9

Analysis

max time kernel
121s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

27fed59e2e432f108a5d09fe93700b3f558aedebffb74f51e5119a79adb96dd9.exe
Size

315KB
MD5

5d2954059bf6455e3fceaf70596e1fa1
SHA1

2e1166ec49a6720c19663e0366d7c277e7e60c4f
SHA256

27fed59e2e432f108a5d09fe93700b3f558aedebffb74f51e5119a79adb96dd9
SHA512

aa9fd7c830748c3dcbcd068434a76674a5b108680deeaaeebcd24c80ab38d2c5dd0289626c537842d280bc83e8c7fa84cbdd65208e058c86237496efff7e0f68
SSDEEP

6144:egbksM/Cia78qRqHUTKk8c4/Y0fograYklfpWh5mCZCl8wZ6:eg/7oqRqHIKDTAr8sC68wZ6

Score

8^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-132-0x0000000000400000-0x00000000004CE000-memory.dmp	upx
behavioral2/memory/4936-133-0x0000000000400000-0x00000000004CE000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	27fed59e2e432f108a5d09fe93700b3f558aedebffb74f51e5119a79adb96dd9.exe
File created	C:\Windows\	27fed59e2e432f108a5d09fe93700b3f558aedebffb74f51e5119a79adb96dd9.exe

C:\Users\Admin\AppData\Local\Temp\27fed59e2e432f108a5d09fe93700b3f558aedebffb74f51e5119a79adb96dd9.exe
"C:\Users\Admin\AppData\Local\Temp\27fed59e2e432f108a5d09fe93700b3f558aedebffb74f51e5119a79adb96dd9.exe"
1⤵
- Drops file in Windows directory
PID:4936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4936-132-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download
memory/4936-133-0x0000000000400000-0x00000000004CE000-memory.dmp

Filesize
824KB

Download