a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc

Analysis

max time kernel
170s
max time network
170s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc.exe
Size

747KB
MD5

0d37159fe351e6c48f17dfda3c06708e
SHA1

b36fe9e57bf1637809b22a2387ad4134320c2719
SHA256

a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc
SHA512

70a647d5f4116fcea500ebc1b7cbb449c175462ad1d78d71feacf1eee2337077da349067b4a6ba032e3c36e34720699c7bd96a6ce159c516118db786b4b1e056
SSDEEP

12288:vG3rwJocU9JdzNiXjRMmHHOgnFCZso+j1aWxSIxuQ2DJ8yC9qXbd85BRH3CIVfxI:+3rXzdZiXjOtgosoKJxSIgLDra5BhN5I

Score

8^/10

discovery persistence upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1168-54-0x0000000000400000-0x0000000000610000-memory.dmp	upx
behavioral1/memory/1168-56-0x0000000000400000-0x0000000000610000-memory.dmp	upx
behavioral1/memory/1168-58-0x0000000000400000-0x0000000000610000-memory.dmp	upx
behavioral1/memory/1168-59-0x0000000000400000-0x0000000000610000-memory.dmp	upx
behavioral1/memory/1168-60-0x0000000000400000-0x0000000000610000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SonyAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc.exe"	a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc.exe
"C:\Users\Admin\AppData\Local\Temp\a1397344966681827588af04eb848e6d406657b6ddf1669e80c7c20fc86bbcbc.exe"
1⤵
- Adds Run key to start application
PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-54-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1168-56-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1168-57-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1168-58-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1168-59-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download
memory/1168-60-0x0000000000400000-0x0000000000610000-memory.dmp

Filesize
2.1MB

Download