f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad

Analysis

max time kernel
151s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe
Size

47KB
MD5

ef636c32623eb2a59ab4a413ff1911b8
SHA1

b0f1bf1a6f0b07ed0a38268f0fc0ca0e41b07c47
SHA256

f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad
SHA512

5d62758f126815808ce38ec2de712c5b54ba8d3d27efeca9712b3ff587650159578ca27e1616ec10754c3d4f3fcf0e5923467bea4162a91b16b836cf23d16e36
SSDEEP

768:nUr1vdFlwnXjAXlIzwQGLiMefkoIRU0zJ0qdw7ElQFXjIlx5KWgIfh4Y:Ur1FFl2szeRfsR99Pw7XTEKG4Y

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1312-54-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/memory/1312-59-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\Client Server Runtime Server subsystem = "\\Users\\Admin\\csrss.exe"	f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1312	f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1312	f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe
1312	f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe

C:\Users\Admin\AppData\Local\Temp\f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe
"C:\Users\Admin\AppData\Local\Temp\f5bf11781b7ea1f7d3d725d4cd0202b7e53df473191fcca92feda1b0534416ad.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-54-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1312-58-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download
memory/1312-59-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download