Overview

overview

8

Static

static

95d1a3c665...e0.exe

windows7-x64

8

95d1a3c665...e0.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 11:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    95d1a3c665a1b711b00016e20cbd80bcc900bbc933590932073f45329689ffe0.exe

  • Size

    371KB

  • MD5

    091fd4a9180dbc35719b987c412cc2a8

  • SHA1

    2a3134ce7b2d27f0bb7d15e8a6b27acfd98eb5a5

  • SHA256

    95d1a3c665a1b711b00016e20cbd80bcc900bbc933590932073f45329689ffe0

  • SHA512

    c6db7814c70d56dd4951a4204641ff5128d863ffbcd0134e8e7d1ca973c2e931b5d4ae29793deb6e834c658bf41d4f6e1f9cec50748332dd787d9668064c29a1

  • SSDEEP

    6144:Zq508irhN7ClivgkF6AiHWjBW0Dd1RjXXIgDCrU6sM1:y03rhN4ivgkgAiHoBzDdjbLDC46X

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95d1a3c665a1b711b00016e20cbd80bcc900bbc933590932073f45329689ffe0.exe
    "C:\Users\Admin\AppData\Local\Temp\95d1a3c665a1b711b00016e20cbd80bcc900bbc933590932073f45329689ffe0.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 684
      2⤵
      • Program crash
      PID:1944
    • C:\oL01603PpJiB01603\oL01603PpJiB01603.exe
      "\oL01603PpJiB01603\oL01603PpJiB01603.exe" "C:\Users\Admin\AppData\Local\Temp\95d1a3c665a1b711b00016e20cbd80bcc900bbc933590932073f45329689ffe0.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 680
        3⤵
        • Program crash
        PID:4208
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4588 -ip 4588
    1⤵
      PID:1332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1220 -ip 1220
      1⤵
        PID:3444

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\oL01603PpJiB01603\oL01603PpJiB01603.exe
              Filesize

              371KB

              MD5

              f58ab69e63e1b275e7b9a4cf0613fcbc

              SHA1

              635056d76ecd1e90ae12f589c528d02ece27ffd5

              SHA256

              346550f83734c33e3ffb06b7ae796de8d914dd43443e48cbb5e56f43d11410ed

              SHA512

              bd18b8c051a11030049b8347a28427ff57463af56a17b872b20c27a0b6ee1a3f68c0fd854b5523bb131343cb01961f2e9eaf98d76f75bb2aab63ffafcdf0cd92

              Download Submit

            • C:\oL01603PpJiB01603\oL01603PpJiB01603.exe
              Filesize

              371KB

              MD5

              f58ab69e63e1b275e7b9a4cf0613fcbc

              SHA1

              635056d76ecd1e90ae12f589c528d02ece27ffd5

              SHA256

              346550f83734c33e3ffb06b7ae796de8d914dd43443e48cbb5e56f43d11410ed

              SHA512

              bd18b8c051a11030049b8347a28427ff57463af56a17b872b20c27a0b6ee1a3f68c0fd854b5523bb131343cb01961f2e9eaf98d76f75bb2aab63ffafcdf0cd92

              Download Submit

            • memory/1220-138-0x0000000000400000-0x00000000004C6000-memory.dmp

              Filesize

              792KB

              Download

            • memory/1220-139-0x0000000000400000-0x00000000004C6000-memory.dmp

              Filesize

              792KB

              Download

            • memory/4588-132-0x0000000000670000-0x0000000000673000-memory.dmp

              Filesize

              12KB

              Download

            • memory/4588-133-0x0000000000400000-0x00000000004C6000-memory.dmp

              Filesize

              792KB

              Download

            • memory/4588-137-0x0000000000400000-0x00000000004C6000-memory.dmp

              Filesize

              792KB

              Download