84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6

Analysis

max time kernel
93s
max time network
99s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe
Size

1.4MB
MD5

fc829ba7c4d14e53af7ea9c3dc7d1ae4
SHA1

8eecfb7675e8c60288613925e968fcaeae24f534
SHA256

84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6
SHA512

b63ec6bd2207cdb6a02ca33156179b74bd06f9f36ca0951e5ce18726fe698a1a6fba40a9b1af5f4f8fb27987a6d68e56b536b72780ca35da9095705c07c2f47f
SSDEEP

24576:O5ZZTIX9chwc9LYW7sv0d91zY6kdLaLjqfWMBemr6kCqs6Ua4LK6EHKBS:O7ZI0wQP7FLcWufWMvrqW6Jg

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1996-55-0x0000000000400000-0x0000000001107000-memory.dmp	upx
behavioral1/memory/1996-56-0x0000000000400000-0x0000000001107000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Manager.exe	84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google.exe = "C:\\Users\\Admin\\AppData\\Local\\Google.exe"	84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bluetooth.exe	84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\HistoryFeeds.exe	84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\XPeria.exe	84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe

pid process

1996 84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe

pid	process
1996	84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe

C:\Users\Admin\AppData\Local\Temp\84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe
"C:\Users\Admin\AppData\Local\Temp\84e67c2aa9c97dee3af077079cae01dae13fe6c0c86b0757d2bbf045f5dfede6.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/1996-55-0x0000000000400000-0x0000000001107000-memory.dmp

Filesize
13.0MB

Download
memory/1996-56-0x0000000000400000-0x0000000001107000-memory.dmp

Filesize
13.0MB

Download