927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 21:06

Target

927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe
Size

18KB
MD5

d5d0d2b1f289647f74a36211660a6f55
SHA1

5c940c14c07d5000245b4007b0cc5b42258247ca
SHA256

927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3
SHA512

e3241f29e33c1c0166f78a489c5217e62ca38336b486e3fc04edf8094475f20d660519606b65ae3a5248c7d97eb58941cfbba07b5c0362de3ea3775aa738c581
SSDEEP

384:GAhgmZVqbcbw+LXW50wHTXWkjSVpI8SYWlOsF1uc9kWBZxRvF70Gs1:G2gvcbw0wHTWkjYI89WlOsFoczZxRvFD

Score

8^/10

discovery upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1064-54-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1744	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1064 wrote to memory of 1744	1064	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	27
PID 1744 wrote to memory of 1360	1744	927f4ab837a4fcd706aa1b192b7229df6b0f6fb1c640ffad2c8440417528fbc3.exe	15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1064-54-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1064-61-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1064-63-0x0000000000250000-0x0000000000262000-memory.dmp

Filesize
72KB

Download
memory/1744-55-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1744-56-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1744-58-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1744-59-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1744-60-0x0000000000401F60-mapping.dmp

Download
memory/1744-62-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1744-64-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/1744-67-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1744-68-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download