22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1.exe
Size

817KB
MD5

14bf0ccff0d4cb780a5c969dded3d688
SHA1

3ccd515d88924bcd709d1111d5ab5703b502b3ec
SHA256

22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1
SHA512

91860d322a5042b366996cb37640d44a6e75e57d7f46ba3d872163e61fc9dd08bb5f2373b6cd23a7062546228ad29c1ffe449d760b70ca354839d45f0ccfa864
SSDEEP

24576:HPKhtIDX4O2ghNAudEYXHaP9DjYYGrJPbC7PSbNj0:HPi0Z2GAud49P8C7Pk

Score

8^/10

persistence upx

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/620-59-0x0000000000400000-0x00000000005A4000-memory.dmp	upx
behavioral1/memory/620-60-0x0000000000400000-0x00000000005A4000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\w1ndows_6c5d = "C:\\Users\\Admin\\AppData\\Roaming\\w1ndows_6c5d.exe"	22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1.exe

C:\Users\Admin\AppData\Local\Temp\22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1.exe
"C:\Users\Admin\AppData\Local\Temp\22811cffad0cb88261155f043304efa7683c1d764f1f50d25bd60e82ce48d9f1.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-54-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/620-55-0x0000000010000000-0x000000001002A000-memory.dmp

Filesize
168KB

Download
memory/620-59-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download
memory/620-60-0x0000000000400000-0x00000000005A4000-memory.dmp

Filesize
1.6MB

Download