Overview

overview

8

Static

static

4ef5e30548...96.exe

windows7-x64

8

4ef5e30548...96.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    193s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 02:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    4ef5e30548ecd44bdbba1908197b58ccbb34d5d7f24d3e7853e63b73c0d4d696.exe

  • Size

    412KB

  • MD5

    4c22e596484fbaae97a091079ac18fe1

  • SHA1

    4af0ca9befa402fa1640e5726af078b605310645

  • SHA256

    4ef5e30548ecd44bdbba1908197b58ccbb34d5d7f24d3e7853e63b73c0d4d696

  • SHA512

    7d7923896c7f6f1863f94a4eda7c645d31fdb88a544659d0690f80a95ca6f30f3c7b3d346d4c80b65b39bf9a4578da9afea0862b8294bf73099ca47e096a497f

  • SSDEEP

    6144:O0BzT8HH1eOBUYnRSGyZbZ3JKeHXPlgKLAxrPe5fxuzUwuCf2ruh8PKObk:Rz8H1eyRRSGyZxJKedOxr2JWUzuY9bk

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ef5e30548ecd44bdbba1908197b58ccbb34d5d7f24d3e7853e63b73c0d4d696.exe
    "C:\Users\Admin\AppData\Local\Temp\4ef5e30548ecd44bdbba1908197b58ccbb34d5d7f24d3e7853e63b73c0d4d696.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\mC01300AhOaE01300\mC01300AhOaE01300.exe
      "\mC01300AhOaE01300\mC01300AhOaE01300.exe" "C:\Users\Admin\AppData\Local\Temp\4ef5e30548ecd44bdbba1908197b58ccbb34d5d7f24d3e7853e63b73c0d4d696.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2196
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 704
        3⤵
        • Program crash
        PID:4476
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 2536 -ip 2536
    1⤵
      PID:640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2196 -ip 2196
      1⤵
        PID:2680

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\mC01300AhOaE01300\mC01300AhOaE01300.exe
              Filesize

              412KB

              MD5

              c56b8dcb677ccd7b825c5844352f941a

              SHA1

              9cadadce7176ee4a26212dd51410e4f61fd05d9b

              SHA256

              27e41a3efc1f49d5b383f4febdc33435600794d0832328aa96108143dd0bf1ca

              SHA512

              e57df253cb15f0c89498718911d8154451824c8c352f6feddcb4d17e8288fd9615630dcfd1ea218e46dbb0c5a61815229582fbf1c598352b20dbd71fbbb70b79

              Download Submit

            • C:\mC01300AhOaE01300\mC01300AhOaE01300.exe
              Filesize

              412KB

              MD5

              c56b8dcb677ccd7b825c5844352f941a

              SHA1

              9cadadce7176ee4a26212dd51410e4f61fd05d9b

              SHA256

              27e41a3efc1f49d5b383f4febdc33435600794d0832328aa96108143dd0bf1ca

              SHA512

              e57df253cb15f0c89498718911d8154451824c8c352f6feddcb4d17e8288fd9615630dcfd1ea218e46dbb0c5a61815229582fbf1c598352b20dbd71fbbb70b79

              Download Submit

            • memory/2196-138-0x0000000000400000-0x00000000004C3000-memory.dmp

              Filesize

              780KB

              Download

            • memory/2196-139-0x0000000000400000-0x00000000004C3000-memory.dmp

              Filesize

              780KB

              Download

            • memory/2536-132-0x0000000002230000-0x0000000002233000-memory.dmp

              Filesize

              12KB

              Download

            • memory/2536-133-0x0000000000400000-0x00000000004C3000-memory.dmp

              Filesize

              780KB

              Download

            • memory/2536-134-0x0000000000400000-0x00000000004C3000-memory.dmp

              Filesize

              780KB

              Download

            • memory/2536-140-0x0000000000400000-0x00000000004C3000-memory.dmp

              Filesize

              780KB

              Download