854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd

Analysis

max time kernel
5s
max time network
78s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-10-2022 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe
Size

160KB
MD5

0c4b2f517c001e6cf64a114857c697d8
SHA1

03aba589546a163230faa1ebfa90111ce33ba1dc
SHA256

854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd
SHA512

d6e6a01fc0b03df2a48ffcbfd8e6b10effe62203206a70b92cd67ff677ab2500f693edd32e96449f9aa670550f77b243034a94c91838efe404cd9327e36e29cb
SSDEEP

1536:3+gDbKlmyJKz5jR7766dxocisPfDsCUjhe+SPBp9oEoTTLgY++++1sY+++++ZDdM:3xbkuVbvLn7Uj3

Score

8^/10

evasion trojan upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/944-64-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/944-63-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/944-60-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/944-59-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/944-57-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/944-67-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/944-98-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/648-104-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/memory/648-107-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1756 set thread context of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe
944	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 1756 wrote to memory of 944	1756	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	27
PID 944 wrote to memory of 820	944	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	28
PID 944 wrote to memory of 820	944	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	28
PID 944 wrote to memory of 820	944	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	28
PID 944 wrote to memory of 820	944	854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe	28

C:\Users\Admin\AppData\Local\Temp\854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe
"C:\Users\Admin\AppData\Local\Temp\854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Users\Admin\AppData\Local\Temp\854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe
  "C:\Users\Admin\AppData\Local\Temp\854b74d6679f72e6969a79e56bb9d8a07456268b795c43da956b9028062a26cd.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\HIFOA.bat" "
    3⤵
    PID:820
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "xplorer" /t REG_SZ /d "C:\Windows\xplorer\xplorer.exe" /f
      4⤵
      PID:992
- - C:\Windows\xplorer\xplorer.exe
    "C:\Windows\xplorer\xplorer.exe"
    3⤵
    PID:604

C:\Windows\xplorer\xplorer.exe
"C:\Windows\xplorer\xplorer.exe"
1⤵
PID:1072
- C:\Windows\syswow64\svchost.exe
  C:\Windows\syswow64\svchost.exe
  2⤵
  PID:1704

C:\Windows\xplorer\xplorer.exe
"C:\Windows\xplorer\xplorer.exe"
1⤵
PID:648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\HIFOA.bat

Filesize
124B

MD5
4e6e99d38b1264af2b53a68c7cd6d648

SHA1
55ffe17732d1d9c539d702a1311ef9674fe7b3cf

SHA256
168d9cdf4849fde3b4817db207e60934b6c877be439289f3fb3a4eb9e4326ff0

SHA512
bde21abed1bfc3dbdd6afc83614aa27c3f33dfbb434e139523ac57ecd84875b0e96a241f5828eda0b055f787ec7f95850b0f4ab0ee752ac36484b2bfd78a859d

Download Submit
C:\Windows\xplorer\xplorer.exe

Filesize
74KB

MD5
7c251e3582b0e3108e508a3edde822e8

SHA1
21402416e9e861352e5da0462dcff18931808989

SHA256
609d0d9a7d087ee6ab501b627216b232a783edfa2bb0c9ff7d69bef2b51f128e

SHA512
9032d322d61fdf22c5ab810a3c6149c5d539659672af33271c48b0349c151ea1d0f33f45eb1e0e29490e8993437a64d53eab64d02a00e082d4a787a463fc8d3e

Download Submit
C:\Windows\xplorer\xplorer.exe

Filesize
81KB

MD5
61df55f213dace67326f638f41fda700

SHA1
1c1f60719e41a3593f502b8570ed344bf6782188

SHA256
f6102b1a97bc5e0b3312a5581e402921f06ca3bc065c7998fc8cf2657f2a56c7

SHA512
dccc5f40d25a1f71516acf10c9db7f008eb6ff9cd237ea0a01502ae6e35ea24d162c18bc5ad410794a10c1d3af4ce955c8bed8d4de9aa679570cafe05c87f43b

Download Submit
C:\Windows\xplorer\xplorer.exe

Filesize
50KB

MD5
cc1cc0f2e4f3626471d4a4e783de19b9

SHA1
9ba5460232dd3ad992031971523acd3ad527c30b

SHA256
66b57bb8d0a46e74424512fbf5fc60a8243e7d692a3a26983b6fd61f652753e2

SHA512
a9337ce4b1aa836fbd71632262904745bc553583498e581f2bd3f2b157e590f89d67873b4282900febd217079347580a4a5136e09630b4528d36ac6338fa1c80

Download Submit
C:\Windows\xplorer\xplorer.exe

Filesize
51KB

MD5
91f45281b8322d5fcd3f390a76458045

SHA1
e160e12ae178bc73607bf8fe8bb3d1a797d5c8a0

SHA256
22bb9d5e1e3065fe54bd7fa9b9ecc734ba7c455e6a8f72d6b93f93330775f0a2

SHA512
6d5fb8f6fc9b04115dbfa51aaaa266f3eb2eb9214909aa2518be23560736d09b8a61c2189d91150fb7febbd3372f55a139ec5521092276ea62da5801caed86d2

Download Submit
\Windows\xplorer\xplorer.exe

Filesize
46KB

MD5
6d1b320d72613727edb998f6750ff506

SHA1
a727f49b2fd4efef3b1d92fec9382344cec01b7a

SHA256
a6065c45d9a4dd08dd69eec54798fd22940cb636226f440ef93810f72722d9cf

SHA512
f3738a3fe8512a59f12591171faf5b128bd0e85525339d497ecbdb0f9e75df437d677c9ea0c2418effefe955ee1906ddb5fcd377d743ec8d8eaf3e1d5dcc46c5

Download Submit
\Windows\xplorer\xplorer.exe

Filesize
31KB

MD5
c53819706cc8ca13f8a34af9695f8a82

SHA1
777efe356be8c9f5673b397238d0f60f46d89565

SHA256
ad23437867b78f351a1a0f73fd64c849e024b27df65b6ccdaa8a6f883aad0a2e

SHA512
318d5d7d554fb660b48fcbd0a378e91afdf51b2068b9f8febbaf402ac4c0ca8301f17a22696a788be4948862395080f2a15984e868b68e757196d0a7db55ae57

Download Submit
\Windows\xplorer\xplorer.exe

Filesize
71KB

MD5
1602f041dfb13f25a6473500821ef100

SHA1
513ca542abc0585998c050db0b02136becc16897

SHA256
2e122c2e48125eb2a36091bbb5068e5cf53687422d8d1a313a9dc30035beefee

SHA512
00b0fe84c5c91070b528d7f79f7d30998a1237bab1a0170c5d59bab1185165a8400ce9aa6102082377e06071e7e009a013f090712258a0f3bda64aa1889516af

Download Submit
\Windows\xplorer\xplorer.exe

Filesize
64KB

MD5
9e5abc3639173cc725d5c52151efcc8a

SHA1
5f9c35c5341a0df9ffe69613411536bde7d448f0

SHA256
731ccd3566bed13128a04059153406d6f3c87de6c4dc7868c68b06286efe52b1

SHA512
53bdb3c8253af7bc5189a009d1fb2142d5a08d6639d9cd3f6246bdc6b9813d84adeb9fc710c64f1e4047c31745edde5219573f3387b2eb8de60999ddcd54f751

Download Submit
memory/604-76-0x0000000000000000-mapping.dmp

Download
memory/648-86-0x00000000004085D0-mapping.dmp

Download
memory/648-104-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/648-107-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/820-69-0x0000000000000000-mapping.dmp

Download
memory/944-68-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/944-63-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/944-64-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/944-98-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/944-67-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/944-61-0x00000000004085D0-mapping.dmp

Download
memory/944-60-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/944-56-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/944-57-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/944-59-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/992-71-0x0000000000000000-mapping.dmp

Download
memory/1072-95-0x000000000040141C-mapping.dmp

Download
memory/1072-93-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1072-101-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1072-89-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1072-90-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1704-100-0x0000000000000000-mapping.dmp

Download
memory/1704-103-0x0000000000080000-0x0000000000085000-memory.dmp

Filesize
20KB

Download
memory/1704-102-0x0000000000CD0000-0x0000000000CD8000-memory.dmp

Filesize
32KB

Download
memory/1704-106-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download
memory/1704-108-0x0000000000020000-0x0000000000025000-memory.dmp

Filesize
20KB

Download