f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094

Analysis

max time kernel
333s
max time network
327s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
Size

28KB
MD5

35e489aa81204b1cb1d284fdad3f1ea0
SHA1

88a635e1a17ff2ea1b1d878d0dcf1d7bc632484b
SHA256

f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094
SHA512

fe912ebdc26fb65520eadc6e58a068fa2b8ff6ba18f01447d631cdf20f0b0fec71186c8719a3af7c025b278f2bd865eb3893fcb72fcfb1cc29c7b38499e7a78f
SSDEEP

768:FZGobYAN4TGm6ufqXo/7mssEknSJn4Lgq:FMoUoQEo3sjen4Eq

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/260-132-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfig = "C:\\Windows\\system32\\1upk3.exe"	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msconfig0 = "C:\\Windows\\system32\\1upk3.exe"	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\1upk3.exe	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	260	f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe

C:\Users\Admin\AppData\Local\Temp\f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe
"C:\Users\Admin\AppData\Local\Temp\f1e4fe2a1627c4bddf0422952990e5c6bd8c03ee4a4d45cd71af5370fcbb0094.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:260
- C:\Users\Admin\AppData\Local\Temp\~24085209.exe
  C:\Users\Admin\AppData\Local\Temp\~24085209.exe
  2⤵
  PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/260-132-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download