Overview

overview

10

Static

static

10

gm.rar

windows7-x64

3

gm.rar

windows10-2004-x64

3

17ffd90d20...e1.dll

windows7-x64

1

17ffd90d20...e1.dll

windows10-2004-x64

1

1caf510598...e1.exe

windows7-x64

10

1caf510598...e1.exe

windows10-2004-x64

1

1d88c47417...67.exe

windows7-x64

1

1d88c47417...67.exe

windows10-2004-x64

5

1ecb597741...af.exe

windows7-x64

1ecb597741...af.exe

windows10-2004-x64

2a5fe7d49f...b5.exe

windows7-x64

1

2a5fe7d49f...b5.exe

windows10-2004-x64

1

2c1aa4fa14...dc.exe

windows7-x64

1

2c1aa4fa14...dc.exe

windows10-2004-x64

1

34d62f47e1...6e.exe

windows7-x64

3

34d62f47e1...6e.exe

windows10-2004-x64

3

38f1b8c868...05.exe

windows7-x64

10

38f1b8c868...05.exe

windows10-2004-x64

10

40d8e3dae5...04.exe

windows7-x64

10

40d8e3dae5...04.exe

windows10-2004-x64

10

410ee08c8a...59.exe

windows7-x64

6

410ee08c8a...59.exe

windows10-2004-x64

6

423b7b37b1...42.exe

windows7-x64

1

423b7b37b1...42.exe

windows10-2004-x64

1

4315b6e87c...0b.exe

windows7-x64

7

4315b6e87c...0b.exe

windows10-2004-x64

7

453c6fe9e1...91.exe

windows7-x64

1

453c6fe9e1...91.exe

windows10-2004-x64

1

4a841216cb...37.exe

windows7-x64

1

4a841216cb...37.exe

windows10-2004-x64

1

4e180437ef...a9.exe

windows7-x64

1

4e180437ef...a9.exe

windows10-2004-x64

1

Resubmissions

07-09-2023 14:45

230907-r45fysaf5s 10

07-09-2023 14:12

230907-rjbyxaad5s 10

Analysis

  • max time kernel
    20s
  • max time network
    27s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2023 14:45

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    1ecb59774182d0d0a04b418249428b621159838bd2bcdc1a3a7b871a65dd90af.exe

  • Size

    611KB

  • MD5

    93c5f1cb9b83533edf1dee9cc40628e2

  • SHA1

    788731b2715d1d1f2405bd6169cede470445fdbc

  • SHA256

    1ecb59774182d0d0a04b418249428b621159838bd2bcdc1a3a7b871a65dd90af

  • SHA512

    f6fafb62d752083f97b54cfd72937e4d5483df812fe2d3425b90b98776356ab7bd049ea735db0ba93d1f424a8d7d8bc627b23a5244080917ef2c9b2400c9c526

  • SSDEEP

    12288:ffHVNgJDiUk6UICjj5Lx/q3RqmRNnw8ZnCeMN0pGoMLTcI1dJH8MSsn3dMVziVH:X1yJDdhlyxCIm3nwQCeMNqGjLYcteAdf

Score
10/10
persistenceupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ecb59774182d0d0a04b418249428b621159838bd2bcdc1a3a7b871a65dd90af.exe
    "C:\Users\Admin\AppData\Local\Temp\1ecb59774182d0d0a04b418249428b621159838bd2bcdc1a3a7b871a65dd90af.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3716
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x4 /state0:0xa398c855 /state1:0x41c64e6d
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3716-0-0x0000000000400000-0x000000000057A000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/3716-1-0x00000000006F0000-0x00000000006F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3716-4-0x0000000000400000-0x000000000057A000-memory.dmp

    Filesize

    1.5MB

    Download