35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50

Analysis

max time kernel
84s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
Size

3.7MB
MD5

24ce983be50beaa6ffd75e062150df25
SHA1

95ff5f560eeb99955282785b7ac84b93fc81bbeb
SHA256

35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50
SHA512

492a241668b2f8b77ed9caed916c999906a58ab10c41359f2fed7757615770d83b37a5ccef70c1aa3c5c246bdb56fbb4cdf922c20f5ba87d383aad1eb7b37127
SSDEEP

98304:baYWXRBUuDwXl4NAO25wQXLVM0zPU6HR7oj:bWBBlS4rA3JMenHhoj

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/856-55-0x00000000009A0000-0x0000000001120000-memory.dmp	upx
behavioral1/memory/856-56-0x00000000009A0000-0x0000000001120000-memory.dmp	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\q:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\s:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\x:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\y:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\a:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\g:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\m:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\p:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\z:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\i:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\k:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\u:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\n:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\r:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\t:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\v:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\b:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\f:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\h:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\j:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\w:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\e:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\l:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
File opened (read-only)	\??\o:	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/856-56-0x00000000009A0000-0x0000000001120000-memory.dmp	autoit_exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
856	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
856	35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe

C:\Users\Admin\AppData\Local\Temp\35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
"C:\Users\Admin\AppData\Local\Temp\35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/856-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/856-55-0x00000000009A0000-0x0000000001120000-memory.dmp

Filesize
7.5MB

Download
memory/856-56-0x00000000009A0000-0x0000000001120000-memory.dmp

Filesize
7.5MB

Download