c15e4c257b8ac5d8c45c8814ffe9dc2c10c7651c80e1c45eaaf0026d255a1705

Analysis

max time kernel
37s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c15e4c257b8ac5d8c45c8814ffe9dc2c10c7651c80e1c45eaaf0026d255a1705.exe
Size

191KB
MD5

b86b4135140d868d8b8e9b4b4ee74050
SHA1

13ddae021b9fb9641a793f5923b4c0c067099c73
SHA256

c15e4c257b8ac5d8c45c8814ffe9dc2c10c7651c80e1c45eaaf0026d255a1705
SHA512

642502f21f822cc69be3f5bd93418e3edfbb4c794a07bdd4a581f967019774494b67e7166d7b969eee1c35752822b5457b95e1a007e60562b9a242bff94520c7
SSDEEP

3072:aBhGrhzNWHamydhFk0Nxqb2os7cz4Wox1cEiehaKxQMm+pPJPMUqrwAgRkkIy0V7:aXY1NWOhFkgxqbccz6cEpwEQ+Prqayk6

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1116-54-0x0000000000400000-0x0000000000484000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	c15e4c257b8ac5d8c45c8814ffe9dc2c10c7651c80e1c45eaaf0026d255a1705.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSupinit = "C:\\Windows\\system32\\MSupinit.exe"	c15e4c257b8ac5d8c45c8814ffe9dc2c10c7651c80e1c45eaaf0026d255a1705.exe

C:\Users\Admin\AppData\Local\Temp\c15e4c257b8ac5d8c45c8814ffe9dc2c10c7651c80e1c45eaaf0026d255a1705.exe
"C:\Users\Admin\AppData\Local\Temp\c15e4c257b8ac5d8c45c8814ffe9dc2c10c7651c80e1c45eaaf0026d255a1705.exe"
1⤵
- Adds Run key to start application
PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-54-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download