a822b90b88e8aad9a799b7c8f9c9e9932fe51f11d8f319b46e26b1931dfb7c3a

Analysis

max time kernel
140s
max time network
166s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a822b90b88e8aad9a799b7c8f9c9e9932fe51f11d8f319b46e26b1931dfb7c3a.exe
Size

502KB
MD5

1622b2ea1ea1950b0e52c2c20fbd3ac0
SHA1

3ac595a36c3079484c9ce85d07b2569aa10b2adf
SHA256

a822b90b88e8aad9a799b7c8f9c9e9932fe51f11d8f319b46e26b1931dfb7c3a
SHA512

622064e45a06a717e70e2db564a42ac1151a12e8709f4fdd236bd3529622d9205871c67039c8c771ac3df8c47b38e8cb143b1153aafc911de7de75a0ffe49fcd
SSDEEP

12288:jSmbN/XnX1HNOF1LeQ3jBZnhWZqkQCJ6m4H1Ph1ADO:jSmbN/XnXDwh3jBZWqbWyHpp

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/916-55-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral1/memory/916-56-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral1/memory/916-57-0x0000000000400000-0x00000000004FD000-memory.dmp	upx
behavioral1/memory/916-58-0x0000000000400000-0x00000000004FD000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\AA2014 = "C:\\ProgramData\\6DsrrVVp\\6DsrrVVp.exe"	a822b90b88e8aad9a799b7c8f9c9e9932fe51f11d8f319b46e26b1931dfb7c3a.exe

C:\Users\Admin\AppData\Local\Temp\a822b90b88e8aad9a799b7c8f9c9e9932fe51f11d8f319b46e26b1931dfb7c3a.exe
"C:\Users\Admin\AppData\Local\Temp\a822b90b88e8aad9a799b7c8f9c9e9932fe51f11d8f319b46e26b1931dfb7c3a.exe"
1⤵
- Adds Run key to start application
PID:916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/916-55-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/916-56-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/916-57-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/916-58-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download