f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe
Size

689KB
MD5

820ef46490377a926250826fe07bbfe4
SHA1

61aa3a4af3c445738dd022ebbe8ac3971a31e029
SHA256

f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e
SHA512

6edf6c71bfc5116b4abbcd719ea2779b3bff2fa836619a14bcc556d2c4503547affc44032ceda99b80d74e022e0d24c424d312db54b8ac5da0b6267507e10f71
SSDEEP

12288:4yIajg6t9gDOzDaWDUD7r0NOxbPYW1U/bMNc0o85m6YRRbTfJVIOcbKUvvsxgoxD:Ya86tf9YuV/INcxowRRbTfrOKUvvEgo5

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5044-132-0x0000000000400000-0x00000000005ED000-memory.dmp	upx
behavioral2/memory/5044-133-0x0000000000400000-0x00000000005ED000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts.scr = "C:\\Windows\\svchosts.scr"	f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchosts.scr	f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe
File opened for modification	C:\Windows\svchosts.scr	f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5044	f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe

C:\Users\Admin\AppData\Local\Temp\f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe
"C:\Users\Admin\AppData\Local\Temp\f386668657dbf95ab97020ce172aa3d88918b7220cbb5e347b917e27b0dbb08e.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:5044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-132-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download
memory/5044-133-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download