dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f

Analysis

max time kernel
2s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02-08-2023 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zeppelinbggaehbcdj18_browsingExe.exe
Size

100KB
MD5

cf5a358a22326f09fd55983bb812b7d8
SHA1

1addcffae4fd4211ea24202783c2ffad6771aa34
SHA256

dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f
SHA512

5e4129009c716286c9a2d85f846c75053d71251c9ab52f440da5a3f1a5cc6d9d7d795753bc7e37ef11353fb694f1c0991d127c28d6cd1188316623aa57cb2e5b
SSDEEP

3072:ge2IWDaNiBBXtw4KLStagKwbzCcO8WWZ5:kIeoiBBXGLSYgZzCx8Wq5

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3836-133-0x0000000000400000-0x0000000000546000-memory.dmp	upx
behavioral2/files/0x000200000001e6d5-140.dat	upx
behavioral2/files/0x000200000001e6d5-143.dat	upx
behavioral2/files/0x000200000001e6d5-142.dat	upx
behavioral2/memory/4664-144-0x0000000000400000-0x0000000000546000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\lsass.exe\" -start"	Zeppelinbggaehbcdj18_browsingExe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\Zeppelinbggaehbcdj18_browsingExe.exe
"C:\Users\Admin\AppData\Local\Temp\Zeppelinbggaehbcdj18_browsingExe.exe"
1⤵
- Adds Run key to start application
PID:3836
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
  2⤵
  PID:4664
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:3132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
100KB

MD5
cf5a358a22326f09fd55983bb812b7d8

SHA1
1addcffae4fd4211ea24202783c2ffad6771aa34

SHA256
dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f

SHA512
5e4129009c716286c9a2d85f846c75053d71251c9ab52f440da5a3f1a5cc6d9d7d795753bc7e37ef11353fb694f1c0991d127c28d6cd1188316623aa57cb2e5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
100KB

MD5
cf5a358a22326f09fd55983bb812b7d8

SHA1
1addcffae4fd4211ea24202783c2ffad6771aa34

SHA256
dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f

SHA512
5e4129009c716286c9a2d85f846c75053d71251c9ab52f440da5a3f1a5cc6d9d7d795753bc7e37ef11353fb694f1c0991d127c28d6cd1188316623aa57cb2e5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
100KB

MD5
cf5a358a22326f09fd55983bb812b7d8

SHA1
1addcffae4fd4211ea24202783c2ffad6771aa34

SHA256
dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f

SHA512
5e4129009c716286c9a2d85f846c75053d71251c9ab52f440da5a3f1a5cc6d9d7d795753bc7e37ef11353fb694f1c0991d127c28d6cd1188316623aa57cb2e5b

Download Submit
memory/3132-145-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Filesize
4KB

Download
memory/3836-133-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download
memory/4664-144-0x0000000000400000-0x0000000000546000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads