Overview

overview

8

Static

static

e4c6779194...1e.exe

windows7-x64

8

e4c6779194...1e.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04-12-2022 13:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe

  • Size

    412KB

  • MD5

    d79801de233b9897454a632f03fee472

  • SHA1

    e51818002bb845edabcedc7f2c756f1b847fcedd

  • SHA256

    e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e

  • SHA512

    9ae469ff2829fe8d06ffc03afedc30d4f8319f223418c9635af4eeac0dec8137b8c981bd9a88d43d873c577e485b6e9f29a054b1003d2e4fb4aed946437c2c28

  • SSDEEP

    6144:2HCFJq6oOsbmv87mIoFCWdlq7q2Va38Xiw892vgzetRsn66zBE:2HCFFxsKIAb6Va3a02+6

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe
    "C:\Users\Admin\AppData\Local\Temp\e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\ProgramData\bD21703OgPhH21703\bD21703OgPhH21703.exe
      "C:\ProgramData\bD21703OgPhH21703\bD21703OgPhH21703.exe" "C:\Users\Admin\AppData\Local\Temp\e4c6779194add0832e31e8e316cddadbcac333608f712eee8505643894a0691e.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:524

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\bD21703OgPhH21703\bD21703OgPhH21703.exe
    Filesize

    412KB

    MD5

    92d1a8a6503e891a708b9716b1b17285

    SHA1

    1e5b43f7e6080b2db54b6c9d5ca3498989c4e71c

    SHA256

    e01cd04a7f181b3682b6e821abdbcabd97c775262b29af350cc1bcb1469baa9e

    SHA512

    ff9482f1f00493924bca3e6ea5142a1e20ba49a1a19dfb0d09a6d78f594533e4dcfe1d1f5c9d0087664922128797e20170bbd8f7af1a2809c85eb9b795473c54

    Download Submit

  • C:\ProgramData\bD21703OgPhH21703\bD21703OgPhH21703.exe
    Filesize

    412KB

    MD5

    92d1a8a6503e891a708b9716b1b17285

    SHA1

    1e5b43f7e6080b2db54b6c9d5ca3498989c4e71c

    SHA256

    e01cd04a7f181b3682b6e821abdbcabd97c775262b29af350cc1bcb1469baa9e

    SHA512

    ff9482f1f00493924bca3e6ea5142a1e20ba49a1a19dfb0d09a6d78f594533e4dcfe1d1f5c9d0087664922128797e20170bbd8f7af1a2809c85eb9b795473c54

    Download Submit

  • \ProgramData\bD21703OgPhH21703\bD21703OgPhH21703.exe
    Filesize

    412KB

    MD5

    92d1a8a6503e891a708b9716b1b17285

    SHA1

    1e5b43f7e6080b2db54b6c9d5ca3498989c4e71c

    SHA256

    e01cd04a7f181b3682b6e821abdbcabd97c775262b29af350cc1bcb1469baa9e

    SHA512

    ff9482f1f00493924bca3e6ea5142a1e20ba49a1a19dfb0d09a6d78f594533e4dcfe1d1f5c9d0087664922128797e20170bbd8f7af1a2809c85eb9b795473c54

    Download Submit

  • \ProgramData\bD21703OgPhH21703\bD21703OgPhH21703.exe
    Filesize

    412KB

    MD5

    92d1a8a6503e891a708b9716b1b17285

    SHA1

    1e5b43f7e6080b2db54b6c9d5ca3498989c4e71c

    SHA256

    e01cd04a7f181b3682b6e821abdbcabd97c775262b29af350cc1bcb1469baa9e

    SHA512

    ff9482f1f00493924bca3e6ea5142a1e20ba49a1a19dfb0d09a6d78f594533e4dcfe1d1f5c9d0087664922128797e20170bbd8f7af1a2809c85eb9b795473c54

    Download Submit

  • memory/524-62-0x0000000000400000-0x00000000004D7000-memory.dmp

    Filesize

    860KB

    Download

  • memory/1112-54-0x0000000074D61000-0x0000000074D63000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1112-55-0x0000000000260000-0x0000000000263000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1112-56-0x0000000000400000-0x00000000004D7000-memory.dmp

    Filesize

    860KB

    Download