62266ce00be3c60de78e1f2df2c1fd9fd4fdd80882858c438886988e35091533

Analysis

max time kernel
136s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

62266ce00be3c60de78e1f2df2c1fd9fd4fdd80882858c438886988e35091533.exe
Size

600KB
MD5

a312d36460c84630791ef3c7355c02c1
SHA1

9106471f791bf6570c472b0238e6771579f9fcf0
SHA256

62266ce00be3c60de78e1f2df2c1fd9fd4fdd80882858c438886988e35091533
SHA512

86dbdecfa6836054bdf95001d00b662cae9702456b4c7d4715df9c6dd6dc60ef3f9f3c8bbf6f22ff4dabbc2855d1e35351984bf61ae59fb85b83a0487ed0286d
SSDEEP

12288:1jv7+jCc+V8QiLlP+EUo2NCwbDpZL6SR:1Xuf+VELlUouJb1NZR

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1160-55-0x0000000000400000-0x00000000004D8000-memory.dmp	upx
behavioral1/memory/1160-58-0x0000000000400000-0x00000000004D8000-memory.dmp	upx
behavioral1/memory/1160-59-0x0000000000400000-0x00000000004D8000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\AS2014 = "C:\\ProgramData\\aDs6UUR7\\aDs6UUR7.exe"	62266ce00be3c60de78e1f2df2c1fd9fd4fdd80882858c438886988e35091533.exe

C:\Users\Admin\AppData\Local\Temp\62266ce00be3c60de78e1f2df2c1fd9fd4fdd80882858c438886988e35091533.exe
"C:\Users\Admin\AppData\Local\Temp\62266ce00be3c60de78e1f2df2c1fd9fd4fdd80882858c438886988e35091533.exe"
1⤵
- Adds Run key to start application
PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/1160-55-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1160-57-0x0000000001E20000-0x0000000001EF8000-memory.dmp

Filesize
864KB

Download
memory/1160-58-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/1160-59-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download