Analysis

  • max time kernel
    144s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 14:49

General

  • Target

    d8affffa895ba6a1c637423716246306df8304a7265d8a6598e14408928d6a5e.exe

  • Size

    153KB

  • MD5

    06e8d94677b65bb618c61917b2bdc7cd

  • SHA1

    b5fbdbe02641d4692e34ddbd5f212759a963fda7

  • SHA256

    d8affffa895ba6a1c637423716246306df8304a7265d8a6598e14408928d6a5e

  • SHA512

    14cedd4509e998abbf87c1e2fb77595e431956a7e044844fe0f259c876a7c8f9956f8dcb72c4cd0071efb460a6ebe6445d9cfbc05dd5b284285861b51eb7a5c0

  • SSDEEP

    3072:uSlqRgH9YRO55T1ldTLSYo3YqFYWPYY8F3x3+/ONIul+X:uokWdT1bLStNFYAr8FBgu

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2640
      • C:\Users\Admin\AppData\Local\Temp\d8affffa895ba6a1c637423716246306df8304a7265d8a6598e14408928d6a5e.exe
        "C:\Users\Admin\AppData\Local\Temp\d8affffa895ba6a1c637423716246306df8304a7265d8a6598e14408928d6a5e.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Users\Admin\AppData\Local\Temp\d8affffa895ba6a1c637423716246306df8304a7265d8a6598e14408928d6a5e.exe
          "C:\Users\Admin\AppData\Local\Temp\d8affffa895ba6a1c637423716246306df8304a7265d8a6598e14408928d6a5e.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5080

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4924-132-0x0000000000400000-0x0000000000454000-memory.dmp

            Filesize

            336KB

          • memory/4924-135-0x0000000000400000-0x0000000000454000-memory.dmp

            Filesize

            336KB

          • memory/4924-141-0x0000000000400000-0x0000000000454000-memory.dmp

            Filesize

            336KB

          • memory/5080-137-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB

          • memory/5080-138-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB

          • memory/5080-139-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB

          • memory/5080-140-0x0000000000400000-0x0000000000417000-memory.dmp

            Filesize

            92KB