Overview

overview

8

Static

static

87860d1bff...a6.exe

windows7-x64

8

87860d1bff...a6.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    154s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 19:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    87860d1bff8fbebcbfcf1424dfab7ad3a7072c91ddce158f20473af2a3f06ea6.exe

  • Size

    401KB

  • MD5

    84e2de84004992d1b16addb3c307a94d

  • SHA1

    5441fee4bf99ab5f9b149d6691c9274e847cef02

  • SHA256

    87860d1bff8fbebcbfcf1424dfab7ad3a7072c91ddce158f20473af2a3f06ea6

  • SHA512

    6d2d457ed21450321c2b2d66db4c8fb723e9b38f9043dbe21c986c317ce45999dafa7a3e03fe07d2ad8b0b0f1ea04a62a8835284f1482591e8d3425927110593

  • SSDEEP

    12288:slhzlptFvg3h+VuV7ohA3kD/NBWBGgl/EYwww:slRlBg3h+GuskDV3g9

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87860d1bff8fbebcbfcf1424dfab7ad3a7072c91ddce158f20473af2a3f06ea6.exe
    "C:\Users\Admin\AppData\Local\Temp\87860d1bff8fbebcbfcf1424dfab7ad3a7072c91ddce158f20473af2a3f06ea6.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 724
      2⤵
      • Program crash
      PID:4156
    • C:\ProgramData\bI01804GpGiC01804\bI01804GpGiC01804.exe
      "C:\ProgramData\bI01804GpGiC01804\bI01804GpGiC01804.exe" "C:\Users\Admin\AppData\Local\Temp\87860d1bff8fbebcbfcf1424dfab7ad3a7072c91ddce158f20473af2a3f06ea6.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 724
        3⤵
        • Program crash
        PID:1552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3292 -ip 3292
    1⤵
      PID:4652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3716 -ip 3716
      1⤵
        PID:4412

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\bI01804GpGiC01804\bI01804GpGiC01804.exe
              Filesize

              401KB

              MD5

              859f6e87782f29cac7901cac539b5b78

              SHA1

              d09558af69a79e97cc3c00686617da7c78c3b8da

              SHA256

              8fae2d102809e7060ffa156d411a306decd307102261586851b22170e861fa01

              SHA512

              d50a3442683f81b21e70edf99e411f720bd1b2c9ccc51cbde8d2a3fab8408b87ae907cf9df86c34bca722303a905624ae36f42b70a22e909eea660db3de6d5d9

              Download Submit

            • C:\ProgramData\bI01804GpGiC01804\bI01804GpGiC01804.exe
              Filesize

              401KB

              MD5

              859f6e87782f29cac7901cac539b5b78

              SHA1

              d09558af69a79e97cc3c00686617da7c78c3b8da

              SHA256

              8fae2d102809e7060ffa156d411a306decd307102261586851b22170e861fa01

              SHA512

              d50a3442683f81b21e70edf99e411f720bd1b2c9ccc51cbde8d2a3fab8408b87ae907cf9df86c34bca722303a905624ae36f42b70a22e909eea660db3de6d5d9

              Download Submit

            • memory/3292-132-0x0000000000690000-0x0000000000693000-memory.dmp

              Filesize

              12KB

              Download

            • memory/3292-136-0x0000000000400000-0x00000000004D0000-memory.dmp

              Filesize

              832KB

              Download

            • memory/3716-137-0x0000000000400000-0x00000000004D0000-memory.dmp

              Filesize

              832KB

              Download