3562c2177283ce1e73bb31754276b83d23266053f645761638cfbd64c3f7394a

Analysis

max time kernel
141s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2023, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Size

372KB
MD5

e9dc058440d321aa17d0600b3ca0ab04
SHA1

539c228b6b332f5aa523e5ce358c16647d8bbe57
SHA256

e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173
SHA512

7e9a18fd03f1ce53e2829683f7aa51bd3ce7794ead29266bcb248e3088342dc369c43f644d31f4671a9a97244bbbfc2add1961b7c760e41b8ddf277bcdb7ebde
SSDEEP

6144:wW3dQfk45aQOVusKHL7G0FJ6KbJLor/XqNjHtBfLptTksD0c2PMM40:FgkOZHvNJ6KbJE/qNBJT/h2PM

Score

8^/10

persistence upx

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\awrdipow\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\awrdipow.sys"	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2600-138-0x0000000000400000-0x00000000004DE000-memory.dmp	upx
behavioral2/memory/2600-139-0x0000000000400000-0x00000000004DE000-memory.dmp	upx
behavioral2/memory/2600-154-0x0000000000400000-0x00000000004DE000-memory.dmp	upx

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2600	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
2600	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Token: SeDebugPrivilege	2600	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Token: SeBackupPrivilege	2600	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Token: SeLoadDriverPrivilege	2600	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe

C:\Users\Admin\AppData\Local\Temp\E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
"C:\Users\Admin\AppData\Local\Temp\E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE15C.tmp

Filesize
193KB

MD5
805418acd5280e97074bdadca4d95195

SHA1
a69e4f03d775a7a0cc5ed2d5569cbfbb4d31d2d6

SHA256
73684e31ad4afe3fdc525b51ccaacc14d402c92db9c42e3fcbfe1e65524b1c01

SHA512
630a255950c0ae0983ae907d20326adea36ce262c7784428a0811b04726849c929bc9cea338a89e77447a6cec30b0889694158327c002566d3cf5be2bb88e4de

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE3DE.tmp

Filesize
3.2MB

MD5
a082710332cd5098ad027c28aeaf5db0

SHA1
34ee1c25ff9f27860d490d1bb36a701877750140

SHA256
258398d6fb140feb9b15db42058373efc253d91a39b8447b0f3373d2d96c8cbe

SHA512
1903e751ed72b0dbf9e2cdf40c946d7ccfd69078bf2ca8d388fdbda85117cdc0217265aef1ef533916962fdb7cf3af5173d3cb3f4768b5e11922384415263e72

Download Submit
memory/2600-138-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2600-139-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/2600-154-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download