7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430

Analysis

max time kernel
139s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
29-08-2023 21:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe
Size

3.3MB
MD5

dd198bd0b1a473649ec80e34f5d183e1
SHA1

fc3447951bbf3db860055aa4592a57842a2b9896
SHA256

7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430
SHA512

476aa89dde3f162967b5bfb78c7ba8791e91f26eb353d7dffb6ce4015b012c7e8edd3fde8f347ea3304f86b410cb5788459132ed6d05a2e88dc27efd85b96e2c
SSDEEP

49152:KpA8kkz9rZFXJX3WRxoOG48lxbe/xdiCvREkrs6k+:KpA1kNX53WRfj+Be/xdvvik46

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2088	box.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2308-22-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-25-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-26-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-27-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-28-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-30-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-32-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-34-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-36-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-38-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-40-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-42-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-44-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-46-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-48-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-52-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-54-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-50-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-56-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-58-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-60-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-62-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-68-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-66-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-64-0x0000000005330000-0x000000000536E000-memory.dmp	upx
behavioral2/memory/2308-69-0x0000000005330000-0x000000000536E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2308	7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe
2308	7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe
2308	7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe
2088	box.exe
2088	box.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2088	2308	7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe	89
PID 2308 wrote to memory of 2088	2308	7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe	89
PID 2308 wrote to memory of 2088	2308	7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe	89

C:\Users\Admin\AppData\Local\Temp\7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe
"C:\Users\Admin\AppData\Local\Temp\7f36440d463914a950f2ba7fb2141d0b378e5e9db54596f5c8669be5c9870430.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Users\Admin\AppData\Local\Temp\box.exe
  "C:\Users\Admin\AppData\Local\Temp\box.exe" -x F983F02DB61EFC6A8D67104C1ABD1267
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\box.exe

Filesize
13.9MB

MD5
f983f02db61efc6a8d67104c1abd1267

SHA1
1fb7662aca21e5ea5a42aa7537c3f1087e86a188

SHA256
7246920f19f06329d5b78093ecd1ea8e5bce7dc77da468cd0dd48cd34ec6f734

SHA512
af3eb7b5f8d3c6373e4899c891dc9feee7aed2974209cb584353c6a14e78971a04ab9f261e61322884b501f4f863314aa296721e4151e6eb95443e97f8c9031d

Download Submit
C:\Users\Admin\AppData\Local\Temp\box.exe

Filesize
13.9MB

MD5
f983f02db61efc6a8d67104c1abd1267

SHA1
1fb7662aca21e5ea5a42aa7537c3f1087e86a188

SHA256
7246920f19f06329d5b78093ecd1ea8e5bce7dc77da468cd0dd48cd34ec6f734

SHA512
af3eb7b5f8d3c6373e4899c891dc9feee7aed2974209cb584353c6a14e78971a04ab9f261e61322884b501f4f863314aa296721e4151e6eb95443e97f8c9031d

Download Submit
C:\Users\Admin\AppData\Local\Temp\box.exe

Filesize
13.9MB

MD5
f983f02db61efc6a8d67104c1abd1267

SHA1
1fb7662aca21e5ea5a42aa7537c3f1087e86a188

SHA256
7246920f19f06329d5b78093ecd1ea8e5bce7dc77da468cd0dd48cd34ec6f734

SHA512
af3eb7b5f8d3c6373e4899c891dc9feee7aed2974209cb584353c6a14e78971a04ab9f261e61322884b501f4f863314aa296721e4151e6eb95443e97f8c9031d

Download Submit
memory/2088-85-0x0000000000400000-0x000000000122C000-memory.dmp

Filesize
14.2MB

Download
memory/2088-83-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2088-94-0x0000000000400000-0x000000000122C000-memory.dmp

Filesize
14.2MB

Download
memory/2088-93-0x0000000003620000-0x0000000003622000-memory.dmp

Filesize
8KB

Download
memory/2088-92-0x0000000003860000-0x0000000003862000-memory.dmp

Filesize
8KB

Download
memory/2088-91-0x0000000000400000-0x000000000122C000-memory.dmp

Filesize
14.2MB

Download
memory/2088-90-0x0000000003610000-0x0000000003612000-memory.dmp

Filesize
8KB

Download
memory/2308-30-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-40-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-11-0x0000000002680000-0x0000000002682000-memory.dmp

Filesize
8KB

Download
memory/2308-12-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/2308-13-0x0000000002720000-0x0000000002722000-memory.dmp

Filesize
8KB

Download
memory/2308-14-0x0000000002710000-0x0000000002712000-memory.dmp

Filesize
8KB

Download
memory/2308-15-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/2308-16-0x00000000026A0000-0x00000000026A2000-memory.dmp

Filesize
8KB

Download
memory/2308-18-0x00000000026E0000-0x00000000026E2000-memory.dmp

Filesize
8KB

Download
memory/2308-17-0x00000000026C0000-0x00000000026C2000-memory.dmp

Filesize
8KB

Download
memory/2308-20-0x0000000002700000-0x0000000002702000-memory.dmp

Filesize
8KB

Download
memory/2308-19-0x00000000026F0000-0x00000000026F2000-memory.dmp

Filesize
8KB

Download
memory/2308-21-0x00000000026D0000-0x00000000026D2000-memory.dmp

Filesize
8KB

Download
memory/2308-22-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-25-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-26-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-27-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-28-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-9-0x0000000002570000-0x0000000002572000-memory.dmp

Filesize
8KB

Download
memory/2308-32-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-34-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-36-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-38-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-10-0x0000000002690000-0x0000000002692000-memory.dmp

Filesize
8KB

Download
memory/2308-42-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-44-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-46-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-48-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-52-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-54-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-50-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-56-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-58-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-60-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-62-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-68-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-66-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-64-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-69-0x0000000005330000-0x000000000536E000-memory.dmp

Filesize
248KB

Download
memory/2308-72-0x0000000002780000-0x0000000002782000-memory.dmp

Filesize
8KB

Download
memory/2308-84-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/2308-8-0x0000000002740000-0x0000000002742000-memory.dmp

Filesize
8KB

Download
memory/2308-6-0x0000000002760000-0x0000000002762000-memory.dmp

Filesize
8KB

Download
memory/2308-5-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/2308-1-0x0000000010000000-0x0000000010015000-memory.dmp

Filesize
84KB

Download
memory/2308-0-0x0000000000400000-0x0000000000786000-memory.dmp

Filesize
3.5MB

Download
memory/2308-87-0x0000000002750000-0x0000000002752000-memory.dmp

Filesize
8KB

Download