Overview

overview

8

Static

static

f75a097848...b8.exe

windows7-x64

8

f75a097848...b8.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 11:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f75a0978486ed19cdc9e05b6dadbdd6dac50b6560e0dd1e0e460c1089810aeb8.exe

  • Size

    380KB

  • MD5

    f9dcb2a3e1c22fd565e2ffe423cde3ab

  • SHA1

    3370f4e28ee882d70f8f9418ef11126e95aa7a52

  • SHA256

    f75a0978486ed19cdc9e05b6dadbdd6dac50b6560e0dd1e0e460c1089810aeb8

  • SHA512

    881d5525a3e6d220ab177220236261c60a07197e034515a01f18e3f8fe0f4fad1dd8147e4811652a2543e86f31db61aa53a238171db0ba711877fd85b682fbc6

  • SSDEEP

    6144:Mbm153RT5miL01XHBNU5xkQIzxqbMDOWaIIvBLysmWhZiqXt+9U9Ptg+sBxL6:Mb453BI1XHBNvQIkQDOBIIxX7hvXsU9c

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f75a0978486ed19cdc9e05b6dadbdd6dac50b6560e0dd1e0e460c1089810aeb8.exe
    "C:\Users\Admin\AppData\Local\Temp\f75a0978486ed19cdc9e05b6dadbdd6dac50b6560e0dd1e0e460c1089810aeb8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 1204
      2⤵
      • Program crash
      PID:4736
    • C:\ProgramData\eE01819FcMbC01819\eE01819FcMbC01819.exe
      "C:\ProgramData\eE01819FcMbC01819\eE01819FcMbC01819.exe" "C:\Users\Admin\AppData\Local\Temp\f75a0978486ed19cdc9e05b6dadbdd6dac50b6560e0dd1e0e460c1089810aeb8.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5028
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 1216
        3⤵
        • Program crash
        PID:3592
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3368 -ip 3368
    1⤵
      PID:932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5028 -ip 5028
      1⤵
        PID:3916

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\eE01819FcMbC01819\eE01819FcMbC01819.exe
        Filesize

        380KB

        MD5

        f89bbcb28b16f9a9e58652350d988455

        SHA1

        46e7c91da9728cc72fcfc560a5620fb9f6d7737f

        SHA256

        3404533e32390a69511f513960e08a50a2cc1fd6f0b965e55f2c2e6781452d69

        SHA512

        f168fa65eac7754b8739447f7c069fc02b3da346bb4e25a098e872693bf1f88ebc8b1c5273ec18737876f0fd8a2178f62c4eb247c67f3c4cd092ce6241921f40

        Download Submit

      • C:\ProgramData\eE01819FcMbC01819\eE01819FcMbC01819.exe
        Filesize

        380KB

        MD5

        f89bbcb28b16f9a9e58652350d988455

        SHA1

        46e7c91da9728cc72fcfc560a5620fb9f6d7737f

        SHA256

        3404533e32390a69511f513960e08a50a2cc1fd6f0b965e55f2c2e6781452d69

        SHA512

        f168fa65eac7754b8739447f7c069fc02b3da346bb4e25a098e872693bf1f88ebc8b1c5273ec18737876f0fd8a2178f62c4eb247c67f3c4cd092ce6241921f40

        Download Submit

      • memory/3368-135-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/5028-136-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download