741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686

Analysis

max time kernel
225s
max time network
336s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25/11/2022, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe
Size

935KB
MD5

8a7149c33bc1e0b15da87b0166af2633
SHA1

87bc903c12ac1e28b0cbe2ca298416a2c452cf68
SHA256

741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686
SHA512

dbb9d49a656cd27102c3a22332df9dd2a4a154fea42c6a8b2c1a203e01abd3d4b3dd769e5bf848143860455f53868630025f49c49cdc1904713594aaa10084a1
SSDEEP

12288:Y5Yr15f753d5QWIDz/Wz9NCyzHinLipNDJ5eoFb0OZ/WiGaks+HL63S27x4:YyHv5Z+Wzv7AiBll0OBWi6si9G

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1944-55-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral1/memory/1944-57-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral1/memory/1944-58-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral1/memory/1944-62-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral1/memory/1944-63-0x0000000000400000-0x00000000004F2000-memory.dmp	upx
behavioral1/memory/1944-64-0x0000000000400000-0x00000000004F2000-memory.dmp	upx

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1892 set thread context of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1944	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29
PID 1892 wrote to memory of 1944	1892	741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe	29

C:\Users\Admin\AppData\Local\Temp\741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe
"C:\Users\Admin\AppData\Local\Temp\741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\AppData\Local\Temp\741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe
  "C:\Users\Admin\AppData\Local\Temp\741c91d92ebee97545e6fa72f7d74bd0666190608a80b28a62746949fb365686.exe" Track="0001101000"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1944-55-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1944-57-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1944-58-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1944-61-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1944-62-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1944-63-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/1944-64-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads