f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a

Analysis

max time kernel
174s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 11:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a.exe
Size

66KB
MD5

3261b2c99ea64dffb81886c5073c4ee9
SHA1

5df127b8e16201f701b40400f75e127ff050315c
SHA256

f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a
SHA512

68d5f3116ca67051eeb8a0b086cbd53310c61bce61eb3974afc7d8b56ce75c1acee900ab6d7ea448dc6a33a18eef81fa370c007cc9350c85bf5c55c1afb9803a
SSDEEP

1536:TjY9M/KHjdpaNf9LhhvhR0QJQFnToIfg3nnMGyF:Tc9M/KH+f9LhhP0QJQtTBfg3nnRyF

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1420-132-0x0000000000400000-0x0000000000412000-memory.dmp	upx
behavioral2/memory/1420-133-0x0000000000400000-0x0000000000412000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\6566 = "c:\\WINDOWS\\system32\\Runr.exe"	f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Runr.exe	f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a.exe
File opened for modification	C:\Windows\SysWOW64\Runr.exe	f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a.exe

C:\Users\Admin\AppData\Local\Temp\f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a.exe
"C:\Users\Admin\AppData\Local\Temp\f1a23836cee32721b8498eeb1aba4329e9a0f1f5fe9cecc2395593d7f4e9fc0a.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1420

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1420-132-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1420-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download