c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125

Analysis

max time kernel
150s
max time network
193s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125.exe
Size

21KB
MD5

21eaf5d08da9d556f5c55e008eaaa296
SHA1

6f3b5f9092341e3112a0b0125f4d0150ecf9da52
SHA256

c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125
SHA512

0e6af0d364b4c897f5050e6f3590d82024cda80ff15a1365f1ed22d909bc88f12fe4e40ac6afde8af342e3864cad22d298a4c30096da2d79a42f581bc6f64f76
SSDEEP

384:FZcpzCIqdG3A3WUkx38GZDJuJbf1+o44u8gHzUnoDRk:SCIqdH/k1ZVcT194jp4oO

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1396-55-0x0000000000800000-0x000000000080D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe"	c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\lsass.exe	c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125.exe
File opened for modification	C:\Windows\lsass.exe	c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125.exe

C:\Users\Admin\AppData\Local\Temp\c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125.exe
"C:\Users\Admin\AppData\Local\Temp\c365f9a66ef153729090a1f930a960c9fcb3333c3ff1e84e1665be87d67ad125.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1396-55-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download