Analysis

  • max time kernel
    51s
  • max time network
    64s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11-05-2023 08:31

General

  • Target

    792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe

  • Size

    277KB

  • MD5

    405035ce873542c0bed986de9feb5718

  • SHA1

    9e2f1ec3109a335936a461d804289f3434ca5344

  • SHA256

    792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208

  • SHA512

    3e33ac120d0f232aac1d292bf6954d43a7cc4293d88c732c0bf7053821914080e9d073d69087a03e106267bb8a94dfc9fcca37e9109fe6c51f6671a178905c86

  • SSDEEP

    6144:3XzKdNY49u8rVkJxaHWgzkx2/bQcFF01netb:Ia4AlCHzzZFF01w

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Executes dropped EXE 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe
    "C:\Users\Admin\AppData\Local\Temp\792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:2896
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:3012

Network

  • flag-us
    DNS
    www.programworkshop.com
    792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe
    Remote address:
    8.8.8.8:53
    Request
    www.programworkshop.com
    IN A
    Response
    www.programworkshop.com
    IN A
    64.106.220.214
  • flag-us
    GET
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe
    Remote address:
    64.106.220.214:80
    Request
    GET /sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/ HTTP/1.1
    User-Agent: /DownloadSecureBrowser
    Host: www.programworkshop.com
    Response
    HTTP/1.1 403 Url not valid
    Cache-Control: private
    Content-Type: text/html
    From: P01
    p3p: CP="ALL DSP COR CURa ADMo DEVa TAIa CONi OUR DELa STP BUS PHY ONL UNI PUR COM NAV DEM STA"
    Date: Thu, 11 May 2023 08:31:14 GMT
    Content-Length: 1233
  • flag-us
    DNS
    214.220.106.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    214.220.106.64.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.254.224.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.254.224.20.in-addr.arpa
    IN PTR
    Response
  • 64.106.220.214:80
    http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/
    http
    792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe
    603 B
    1.7kB
    6
    4

    HTTP Request

    GET http://www.programworkshop.com/sbrowser/ws/getconfiguration.aspx?agentidentifier=wincsecb&programid=264&environment=production&starturl=ahr0chm6ly9ldgvzdhnvbmxpbmuub3jnl2h0bww1lymvvgvzdexvz2lul0xvz2lulya=&shortcut=0&cmd=download&sc=0cd898db665ede681f83200836a09aa8593fc92a/

    HTTP Response

    403
  • 20.189.173.6:443
    322 B
    7
  • 8.247.210.254:80
    322 B
    7
  • 8.8.8.8:53
    www.programworkshop.com
    dns
    792432109adbcc3cf2e34bc31aaf3b78be0e6608a03f1264cf0d3e8d0a470208.exe
    69 B
    85 B
    1
    1

    DNS Request

    www.programworkshop.com

    DNS Response

    64.106.220.214

  • 8.8.8.8:53
    214.220.106.64.in-addr.arpa
    dns
    73 B
    154 B
    1
    1

    DNS Request

    214.220.106.64.in-addr.arpa

  • 8.8.8.8:53
    73.254.224.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    73.254.224.20.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

  • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

    Filesize

    87KB

    MD5

    368332fca74f48697d842c5f4698ae1d

    SHA1

    0275153a1e62bd0eca0b02168895517ed66aac56

    SHA256

    3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

    SHA512

    fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

  • memory/2456-122-0x0000000000E10000-0x0000000000EB0000-memory.dmp

    Filesize

    640KB

  • memory/2456-129-0x0000000000E10000-0x0000000000EB0000-memory.dmp

    Filesize

    640KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.