fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f

Analysis

max time kernel
27s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe
Size

90KB
MD5

6012cd2cd53b7146d98d7dc9a35a915c
SHA1

483be2dbaffcb1d5bc64b17f5befb7697eac42d8
SHA256

fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f
SHA512

20b1089ff481374d70d1eaf9a75a9bf46099e0ad3f9c3bb6f2c4df58cea8bcc83c19363a73c82d4a4bad2db3870e99212d35c888a9cf6627666ffa5b654abe88
SSDEEP

1536:RcgKj/QfjpUK+OtwQR5LY8eRH2ZyqmTS/0ekBdHHJ2ML5BDYcfbU:REAr+OtwQRJyH2IbG+dJ2GThbU

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe"	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1668-55-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1668-57-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1668-58-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1668-61-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1668-62-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1668-63-0x0000000000400000-0x0000000000419000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Shell22 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe"	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27
PID 2032 wrote to memory of 1668	2032	fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe	27

C:\Users\Admin\AppData\Local\Temp\fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe
"C:\Users\Admin\AppData\Local\Temp\fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe
  "C:\Users\Admin\AppData\Local\Temp\fb20d8c51a6b8aeabb76af3edf7135b1f8e1a6bf773b125fc3bd198335f2c89f.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1668-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1668-57-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1668-58-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1668-61-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1668-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1668-63-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads