ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c

Analysis

max time kernel
136s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c.exe
Size

56KB
MD5

16447f9de13048d77f077eee7788b1cf
SHA1

02765ce15c60281fb65348d05b3f53c4b1941909
SHA256

ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c
SHA512

2c30900f9ea3323f5af735a9fa61b83e2734edab91c42239121ad094da81a609fea16f14cc821b393cd0fed0b9b5fcb4a2e56861c14ebaf2df4b93a245a9431d
SSDEEP

1536:0ItkeSTQBT+h7TURuyQFmeF/50Pc0cuMc5:y7EOaXQFmS/50Pllp5

Score

8^/10

persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3500-132-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral2/memory/3500-135-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c = "C:\\Users\\Admin\\AppData\\Roaming\\ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c.exe"	ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3500	ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c.exe

C:\Users\Admin\AppData\Local\Temp\ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c.exe
"C:\Users\Admin\AppData\Local\Temp\ef8f572440b8307e7fb3698bc9310a9249e0c371f533d3058c2c5eb86e8c998c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3500-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/3500-135-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download