Overview

overview

8

Static

static

f2683bd03c...06.exe

windows7-x64

8

f2683bd03c...06.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    181s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 22:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f2683bd03ce0416e64f6a733eb615218eda04edbff935c5af0863b06046e7706.exe

  • Size

    412KB

  • MD5

    6eb51526bd20215fa713cf90ff8af2be

  • SHA1

    3ebd0544353b6e4a1baccb28cbb6ba1631e5c66c

  • SHA256

    f2683bd03ce0416e64f6a733eb615218eda04edbff935c5af0863b06046e7706

  • SHA512

    f0cab02dcb7e44858681c63f94390c528b3133205d88c0a9d6e45600f90fead61ad2ed6d838416f259ce9243763ed3fcc1a66a4c4a239783ae714d233ab37b39

  • SSDEEP

    12288:91IrbymZSZR63yT/4+ReZ/5lax1EyLLIVVy9h:7R60g+g5QxayLiV6h

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2683bd03ce0416e64f6a733eb615218eda04edbff935c5af0863b06046e7706.exe
    "C:\Users\Admin\AppData\Local\Temp\f2683bd03ce0416e64f6a733eb615218eda04edbff935c5af0863b06046e7706.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1400
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 896
      2⤵
      • Program crash
      PID:4432
    • C:\mN21703EhBaI21703\mN21703EhBaI21703.exe
      "\mN21703EhBaI21703\mN21703EhBaI21703.exe" "C:\Users\Admin\AppData\Local\Temp\f2683bd03ce0416e64f6a733eb615218eda04edbff935c5af0863b06046e7706.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4884
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 896
        3⤵
        • Program crash
        PID:4632
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1400 -ip 1400
    1⤵
      PID:1744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4884 -ip 4884
      1⤵
        PID:4528

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\mN21703EhBaI21703\mN21703EhBaI21703.exe
              Filesize

              412KB

              MD5

              661ba41a297bc25e0042fa767d181d74

              SHA1

              840f1d2f5bf1fbb49207bc7a86f98661a71ce1e5

              SHA256

              85f18d38e851e023cebf9e692818ccbb31cb3fbf1f1291a5129d943de8d87f8c

              SHA512

              f106c6ca978c13a96c0dcc9c21597ef7f850020bfd6d4e15d961d4a758ef504bbd1f499889c9bfc8a9e25c2fb3cd507e826c916b674ee8b7b5ab66791b3476f8

              Download Submit

            • C:\mN21703EhBaI21703\mN21703EhBaI21703.exe
              Filesize

              412KB

              MD5

              661ba41a297bc25e0042fa767d181d74

              SHA1

              840f1d2f5bf1fbb49207bc7a86f98661a71ce1e5

              SHA256

              85f18d38e851e023cebf9e692818ccbb31cb3fbf1f1291a5129d943de8d87f8c

              SHA512

              f106c6ca978c13a96c0dcc9c21597ef7f850020bfd6d4e15d961d4a758ef504bbd1f499889c9bfc8a9e25c2fb3cd507e826c916b674ee8b7b5ab66791b3476f8

              Download Submit

            • memory/1400-132-0x0000000002750000-0x0000000002753000-memory.dmp

              Filesize

              12KB

              Download

            • memory/1400-133-0x0000000000400000-0x00000000004D7000-memory.dmp

              Filesize

              860KB

              Download

            • memory/1400-134-0x0000000000400000-0x00000000004D7000-memory.dmp

              Filesize

              860KB

              Download

            • memory/1400-140-0x0000000000400000-0x00000000004D7000-memory.dmp

              Filesize

              860KB

              Download

            • memory/4884-138-0x0000000000400000-0x00000000004D7000-memory.dmp

              Filesize

              860KB

              Download

            • memory/4884-139-0x0000000000400000-0x00000000004D7000-memory.dmp

              Filesize

              860KB

              Download