07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26/08/2023, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
Size

5.3MB
MD5

076579896c948e1c2d6828c985a13aac
SHA1

f61da398669160ef6dbfbe71fb0bf01c262e541a
SHA256

07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd
SHA512

737279195a8feb9aef460bd86688ea0a7bc0be3c900ceed132107ee878bf0503723a50ea85c6e2d003c903027c920bad5e82c78d1c16d925b75231f788a45d8d
SSDEEP

98304:rkZ/0e1DNstR9XUokx0AJ87k/QljWCXbz49:g6f/9XUjxNJ8FjW2I9

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1400-0-0x0000000000400000-0x0000000001098000-memory.dmp	upx
behavioral1/memory/1400-1-0x0000000000400000-0x0000000001098000-memory.dmp	upx
behavioral1/memory/1400-4-0x0000000000400000-0x0000000001098000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\G:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\H:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\Q:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\R:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\L:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\S:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\T:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\U:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\I:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\J:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\K:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\M:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\P:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\X:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\Y:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\N:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\O:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\V:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\W:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
File opened (read-only)	\??\Z:	07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe

C:\Users\Admin\AppData\Local\Temp\07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe
"C:\Users\Admin\AppData\Local\Temp\07d004e5eb5719b6ae236cad6dc4c850e27ff99054b4ebebd2ff0137291069fd.exe"
1⤵
- Enumerates connected drives
PID:1400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1400-0-0x0000000000400000-0x0000000001098000-memory.dmp

Filesize
12.6MB

Download
memory/1400-1-0x0000000000400000-0x0000000001098000-memory.dmp

Filesize
12.6MB

Download
memory/1400-2-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1400-3-0x0000000002AA0000-0x0000000002B57000-memory.dmp

Filesize
732KB

Download
memory/1400-4-0x0000000000400000-0x0000000001098000-memory.dmp

Filesize
12.6MB

Download
memory/1400-5-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1400-6-0x0000000002AA0000-0x0000000002B57000-memory.dmp

Filesize
732KB

Download