85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897

Analysis

max time kernel
37s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897.exe
Size

79KB
MD5

65ccc25f50cbd457f62cfa0dac2e0cf0
SHA1

292ec6dc83af710aba923eb3662f011e50b94b11
SHA256

85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897
SHA512

98178b59e3ca82cdd6af99cf7dca14dd3403ee635f96b2b06e43f012a9ff658aec042a72326ed05346f4590f5edf774d9d05ea9104978fc9183d8d68c4e10331
SSDEEP

1536:MHoSCdeVMCT6ggMw4Y7FgG2xV89mTr39w6XJJzVt/2YRmA7hGRIULTU3:MHoLde/OgV432UcP39hXJZn/UEjUg

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1424-54-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/memory/1424-56-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Wqk.dll	85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897.exe
File created	C:\Windows\SysWOW64\Wqk.dll	85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\dextor32.exe	85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897.exe

C:\Users\Admin\AppData\Local\Temp\85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897.exe
"C:\Users\Admin\AppData\Local\Temp\85f1b1bc27c13a1b00861e83319fdff6998ee6c25437be016ce9962bf50dc897.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1424-54-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1424-55-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/1424-56-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download