9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910

Analysis

max time kernel
77s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910.exe
Size

1.5MB
MD5

0f4d059e1fa97575e47e47250c6ecdd3
SHA1

bc4c126be4fd2f4b8ae0cdbc63713f5799da4950
SHA256

9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910
SHA512

29b88bbcf6253cb1f4ea99f9f71b4624d02ee4b11ffa0e034d00b9436a78ec49f60984667cbe6d7b53b150c44c261930f1df03c1a1a00e88f2b3eacca9bddc6b
SSDEEP

24576:sCRdd0SJdL0EIkmEj6xer0kcOfYV9VrwLiaE3TAr+f1cFA1GqZDjpwY:sSGIJmi4iRcOfYV9aLiaE3U812yGq1iY

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1048-54-0x0000000000400000-0x0000000000A7B000-memory.dmp	upx
behavioral1/memory/1048-55-0x0000000000400000-0x0000000000A7B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910.exe"	9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1048	9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910.exe

C:\Users\Admin\AppData\Local\Temp\9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910.exe
"C:\Users\Admin\AppData\Local\Temp\9743401c06ed00f5224f08775d26d1284f889061c87211c3b10cf1f0e7bb4910.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-54-0x0000000000400000-0x0000000000A7B000-memory.dmp

Filesize
6.5MB

Download
memory/1048-55-0x0000000000400000-0x0000000000A7B000-memory.dmp

Filesize
6.5MB

Download