a922ac00f7a3b678f58deedf1e2957c31ac9aae6358710c4ce5b5866a030f566

Analysis

max time kernel
137s
max time network
147s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a922ac00f7a3b678f58deedf1e2957c31ac9aae6358710c4ce5b5866a030f566.exe
Size

522KB
MD5

946d838c3c34c21c0e02b01da4bab8dd
SHA1

338f3076a07094dad053e5c3fee8258df0aa4987
SHA256

a922ac00f7a3b678f58deedf1e2957c31ac9aae6358710c4ce5b5866a030f566
SHA512

64f92a62f00edb23350b52d9f66ea1e2d7f847566063d7cde43b8916b79dd5b92d0620819542f4ac620d64f0cd6fcc30720d7bb9840ac82bac76e0e463fbf080
SSDEEP

12288:apVb8L4MtfjkopdqK/QRnp1w9cZJBYP543g4qXf3k:apVb0BfpdqKoR3wiZJBYG3gbvk

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1752-56-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/1752-55-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/1752-57-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/1752-58-0x0000000000400000-0x00000000004C7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a922ac00f7a3b678f58deedf1e2957c31ac9aae6358710c4ce5b5866a030f566.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\AS2014 = "C:\\ProgramData\\aDs6UUR7\\aDs6UUR7.exe"	a922ac00f7a3b678f58deedf1e2957c31ac9aae6358710c4ce5b5866a030f566.exe

C:\Users\Admin\AppData\Local\Temp\a922ac00f7a3b678f58deedf1e2957c31ac9aae6358710c4ce5b5866a030f566.exe
"C:\Users\Admin\AppData\Local\Temp\a922ac00f7a3b678f58deedf1e2957c31ac9aae6358710c4ce5b5866a030f566.exe"
1⤵
- Adds Run key to start application
PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/1752-56-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1752-55-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1752-57-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1752-58-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download