2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1

Analysis

max time kernel
36s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe
Size

100KB
MD5

90de31fba7aede9ef9c9fe69e097e031
SHA1

f90fc4747ea10ce1bae676b0049cdfec712bb45e
SHA256

2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1
SHA512

6a991173d271191da56cab457d0f5a3fbade767964d3ca1c816935ef5d4db5201675c615370f71abe004f4be1c377a63d2e941cbc220fe62878ad315c4b12433
SSDEEP

1536:nVug2m0NJc5TEfIUkwU+aetfhuZzuZe2i1wpp7xGPY6U2uvwQN980QH/y:VMHcuIXwxsjggPY6U5wQNbQH/y

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-56-0x0000000000400000-0x0000000000442000-memory.dmp	upx
behavioral1/memory/1976-117-0x0000000000400000-0x0000000000442000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe
1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe
1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe
1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe
1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1568	1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe	26
PID 1976 wrote to memory of 1568	1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe	26
PID 1976 wrote to memory of 1568	1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe	26
PID 1976 wrote to memory of 1568	1976	2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe	26

C:\Users\Admin\AppData\Local\Temp\2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe
"C:\Users\Admin\AppData\Local\Temp\2d929d7bfbb37df5e98321d419f517d1b9dec7acd9f7ee0e2a9326adc50746d1.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  PID:1568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\5C25.tmp

Filesize
1.2MB

MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\5D7D.tmp

Filesize
1.1MB

MD5
9b98d47916ead4f69ef51b56b0c2323c

SHA1
290a80b4ded0efc0fd00816f373fcea81a521330

SHA256
96e0ae104c9662d0d20fdf59844c2d18334e5847b6c4fc7f8ce4b3b87f39887b

SHA512
68b67021f228d8d71df4deb0b6388558b2f935a6aa466a12199cd37ada47ee588ea407b278d190d3a498b0ef3f5f1a2573a469b7ea5561ab2e7055c45565fe94

Download Submit
\Users\Admin\AppData\Local\Temp\602D.tmp

Filesize
202KB

MD5
7ff15a4f092cd4a96055ba69f903e3e9

SHA1
a3d338a38c2b92f95129814973f59446668402a8

SHA256
1b594e6d057c632abb3a8cf838157369024bd6b9f515ca8e774b22fe71a11627

SHA512
4b015d011c14c7e10568c09bf81894681535efb7d76c3ef9071fffb3837f62b36e695187b2d32581a30f07e79971054e231a2ca4e8ad7f0f83d5876f8c086dae

Download Submit
memory/1568-116-0x0000000000000000-mapping.dmp

Download
memory/1568-118-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download
memory/1976-55-0x00000000002F0000-0x00000000003B0000-memory.dmp

Filesize
768KB

Download
memory/1976-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1976-59-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-65-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-66-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-67-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-69-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-68-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-70-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-71-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-72-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-73-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-74-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-75-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-76-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-77-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-78-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-79-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-80-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-81-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-82-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-85-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-86-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-84-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-83-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-88-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-89-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-87-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-91-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-90-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-92-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-94-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-93-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-95-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-96-0x00000000754E1000-0x00000000754E3000-memory.dmp

Filesize
8KB

Download
memory/1976-97-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-98-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-99-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-100-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-101-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-102-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-103-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-104-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-105-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-106-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-107-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-108-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-109-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-110-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-111-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-112-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-113-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-114-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-115-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/1976-117-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download