Overview

overview

8

Static

static

aa94e7ef4f...a4.exe

windows7-x64

8

aa94e7ef4f...a4.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2022, 15:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    aa94e7ef4face29effbe2a55c79cce24b5570fe1fce96da1e5640488a56075a4.exe

  • Size

    461KB

  • MD5

    635ff47f857e23272a2f684d2407a936

  • SHA1

    4d7094e4d661fca02cb56fa84ca8a1ef86776258

  • SHA256

    aa94e7ef4face29effbe2a55c79cce24b5570fe1fce96da1e5640488a56075a4

  • SHA512

    936106d0f484c1a2cdcc9f5348aa5067ed4e3925eaeeb8bd1152f06580a55501fc42385127874bfe29bd3dd0cb5a87a98e3365f6f9a914a64eb940128e452d47

  • SSDEEP

    6144:GNMfI4w3Iq1QsH85mZN9wBIthZB/wrOUydnu1yHhSVPbQBZdOXNDzM/DdAUH7jyw:NIQsHe+zZVwrBydu0MPbQqaDQam9Rq

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aa94e7ef4face29effbe2a55c79cce24b5570fe1fce96da1e5640488a56075a4.exe
    "C:\Users\Admin\AppData\Local\Temp\aa94e7ef4face29effbe2a55c79cce24b5570fe1fce96da1e5640488a56075a4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\ProgramData\fG06504OmJfH06504\fG06504OmJfH06504.exe
      "C:\ProgramData\fG06504OmJfH06504\fG06504OmJfH06504.exe" "C:\Users\Admin\AppData\Local\Temp\aa94e7ef4face29effbe2a55c79cce24b5570fe1fce96da1e5640488a56075a4.exe"
      2⤵
      • Executes dropped EXE
      • Deletes itself
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1984

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\fG06504OmJfH06504\fG06504OmJfH06504.exe
          Filesize

          461KB

          MD5

          98a6984508a3fb92da3467da9868bbef

          SHA1

          36561681d1e10530b35454f161859501cb7d6c26

          SHA256

          17a831f965f91e4ebbed4b31870f7c301dfcbf4abaebfd54780a7356b6a2ee6e

          SHA512

          6e1fefd0ae540b5b9f04a1e3e523b4465004dc2a70d3f036ed21affd6e436a32a054f61410dbd2dddb53f52ba48e98bd4ec16233a7e7798884f1cef83b1d6784

          Download Submit

        • C:\ProgramData\fG06504OmJfH06504\fG06504OmJfH06504.exe
          Filesize

          461KB

          MD5

          98a6984508a3fb92da3467da9868bbef

          SHA1

          36561681d1e10530b35454f161859501cb7d6c26

          SHA256

          17a831f965f91e4ebbed4b31870f7c301dfcbf4abaebfd54780a7356b6a2ee6e

          SHA512

          6e1fefd0ae540b5b9f04a1e3e523b4465004dc2a70d3f036ed21affd6e436a32a054f61410dbd2dddb53f52ba48e98bd4ec16233a7e7798884f1cef83b1d6784

          Download Submit

        • \ProgramData\fG06504OmJfH06504\fG06504OmJfH06504.exe
          Filesize

          461KB

          MD5

          98a6984508a3fb92da3467da9868bbef

          SHA1

          36561681d1e10530b35454f161859501cb7d6c26

          SHA256

          17a831f965f91e4ebbed4b31870f7c301dfcbf4abaebfd54780a7356b6a2ee6e

          SHA512

          6e1fefd0ae540b5b9f04a1e3e523b4465004dc2a70d3f036ed21affd6e436a32a054f61410dbd2dddb53f52ba48e98bd4ec16233a7e7798884f1cef83b1d6784

          Download Submit

        • \ProgramData\fG06504OmJfH06504\fG06504OmJfH06504.exe
          Filesize

          461KB

          MD5

          98a6984508a3fb92da3467da9868bbef

          SHA1

          36561681d1e10530b35454f161859501cb7d6c26

          SHA256

          17a831f965f91e4ebbed4b31870f7c301dfcbf4abaebfd54780a7356b6a2ee6e

          SHA512

          6e1fefd0ae540b5b9f04a1e3e523b4465004dc2a70d3f036ed21affd6e436a32a054f61410dbd2dddb53f52ba48e98bd4ec16233a7e7798884f1cef83b1d6784

          Download Submit

        • memory/1112-60-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/1112-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1112-56-0x0000000000610000-0x000000000065E000-memory.dmp

          Filesize

          312KB

          Download

        • memory/1112-61-0x0000000000610000-0x000000000065E000-memory.dmp

          Filesize

          312KB

          Download

        • memory/1112-55-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/1984-64-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/1984-65-0x0000000000300000-0x000000000034E000-memory.dmp

          Filesize

          312KB

          Download

        • memory/1984-67-0x0000000000400000-0x00000000004C4000-memory.dmp

          Filesize

          784KB

          Download

        • memory/1984-68-0x0000000000300000-0x000000000034E000-memory.dmp

          Filesize

          312KB

          Download