4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544

General

Target

4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe
Size

1.1MB
MD5

df76c0ba73fe22cd811be9e62dba28cd
SHA1

af0f13a3ad5ff24b965c74c6427a7d0a766b8e25
SHA256

4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544
SHA512

a593d43a1245b96fb8f8a1edc495d1f4feeb3b12ff2401e27f70048210c6968c15ea8f4c40d26f036fc393d12775426e1d843b71b59992a140cf0dbc7ae8ac93
SSDEEP

12288:5R3qLaF4PGR2eLFrhQMh2yHSnuIs3GbHYvm5TMHqLm2nQzC/SMZoSz/2pu:5ZqLaF4PGweLFeBcSuIyGfTQqCcQzJMD

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3952-134-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-137-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-136-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-138-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-139-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-141-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-143-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-145-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-147-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-149-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-151-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-157-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-155-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-153-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-161-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-159-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-163-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-165-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-167-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-169-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-171-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-173-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-175-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-177-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-179-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-181-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral2/memory/3952-183-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4056	3952	WerFault.exe	82
4084	3952	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3952	4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe
3952	4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe
3952	4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe
3952	4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe
3952	4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe

C:\Users\Admin\AppData\Local\Temp\4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe
"C:\Users\Admin\AppData\Local\Temp\4c4682bfbcd57f928b434eb3c028449c83f7fee597cdfd3d8a2a538e08f22544.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3952
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1744
  2⤵
  - Program crash
  PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 1744
  2⤵
  - Program crash
  PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3952 -ip 3952
1⤵
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3952 -ip 3952
1⤵
PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3952-132-0x00000000003A0000-0x00000000004E4000-memory.dmp

Filesize
1.3MB

Download
memory/3952-133-0x0000000036B00000-0x0000000036B10000-memory.dmp

Filesize
64KB

Download
memory/3952-134-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-137-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-136-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-138-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-139-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-141-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-143-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-145-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-147-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-149-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-151-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-157-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-155-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-153-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-161-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-159-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-163-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-165-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-167-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-169-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-171-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-173-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-175-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-177-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-179-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-180-0x00000000003A0000-0x00000000004E4000-memory.dmp

Filesize
1.3MB

Download
memory/3952-181-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/3952-182-0x00000000003A0000-0x00000000004E4000-memory.dmp

Filesize
1.3MB

Download
memory/3952-183-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing