242ff0d478e782aca371ff9892c14225d47052acb304f9d068be1c1bf0ae3e16

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/07/2023, 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff3211b63f8e61exe_JC.exe
Size

77KB
MD5

ff3211b63f8e613281970139d2386946
SHA1

4706fa834e664ae6d274c6dd0b1ac368cc57ff13
SHA256

242ff0d478e782aca371ff9892c14225d47052acb304f9d068be1c1bf0ae3e16
SHA512

c3138a194fa825891ee0a16d7f366b7b1aa626c96cfb4bcc85655c9d6943d3a150e4f2f60fcb3c14403b82de6aee7ba9c95f0518bd45678d3635aaadac59631f
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOTdSWCPRMoA:T6a+rdOOtEvwDpjNN

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1532	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2232	ff3211b63f8e61exe_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-53-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012024-64.dat	upx
behavioral1/memory/2232-67-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012024-68.dat	upx
behavioral1/memory/1532-69-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012024-78.dat	upx
behavioral1/memory/1532-79-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1532	2232	ff3211b63f8e61exe_JC.exe	28
PID 2232 wrote to memory of 1532	2232	ff3211b63f8e61exe_JC.exe	28
PID 2232 wrote to memory of 1532	2232	ff3211b63f8e61exe_JC.exe	28
PID 2232 wrote to memory of 1532	2232	ff3211b63f8e61exe_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\ff3211b63f8e61exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ff3211b63f8e61exe_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
3bc40d82d548befa9f31d31d74f03e6f

SHA1
5f67608ee7558445ababdb23f1099c0a54124e5e

SHA256
b3104271acb32b8ce8697696b30bc7fd976dd9e65007fc1f7005ac39a59bb227

SHA512
a8bc6e201c559f8977ffa85ad001e4dcc8b4944565383a4d3364f5d887e7822fef01c83539f428612b07a07ec1b0696734d4f51087f12dcd29bf73c09bd9db49

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
3bc40d82d548befa9f31d31d74f03e6f

SHA1
5f67608ee7558445ababdb23f1099c0a54124e5e

SHA256
b3104271acb32b8ce8697696b30bc7fd976dd9e65007fc1f7005ac39a59bb227

SHA512
a8bc6e201c559f8977ffa85ad001e4dcc8b4944565383a4d3364f5d887e7822fef01c83539f428612b07a07ec1b0696734d4f51087f12dcd29bf73c09bd9db49

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
3bc40d82d548befa9f31d31d74f03e6f

SHA1
5f67608ee7558445ababdb23f1099c0a54124e5e

SHA256
b3104271acb32b8ce8697696b30bc7fd976dd9e65007fc1f7005ac39a59bb227

SHA512
a8bc6e201c559f8977ffa85ad001e4dcc8b4944565383a4d3364f5d887e7822fef01c83539f428612b07a07ec1b0696734d4f51087f12dcd29bf73c09bd9db49

Download Submit
memory/1532-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1532-72-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1532-71-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1532-79-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2232-53-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2232-54-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2232-56-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2232-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2232-67-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download