2344f02c3726d94bb0c78f8c6ee6518b0fdb5aebc9fe53664c9419d19dc47dda

Analysis

max time kernel
207s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b601211381a0c078f6d7617cf8159350_exe32.exe
Size

200KB
MD5

b601211381a0c078f6d7617cf8159350
SHA1

fdbf6a98e7da4a162fe1dcf2e99b6984a39cddce
SHA256

2344f02c3726d94bb0c78f8c6ee6518b0fdb5aebc9fe53664c9419d19dc47dda
SHA512

fa035e7e461bb615fd3b1d222ecbfe17c64a46780e7bf206467478efc0a9c90054b56f2ca3128ff516947c630b08b5a731260d82248936ada27c10cc0be16813
SSDEEP

6144:+v2l9mmNYmoZ9rajNIgUE2zbFwFWo/bGqd:D/mKmZYj2gvEbFwF//L

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
1964	cpuirzc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3048-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/memory/3048-1-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/files/0x000200000002288b-10.dat	upx
behavioral2/files/0x000200000002288b-12.dat	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\cpuirzc.exe	b601211381a0c078f6d7617cf8159350_exe32.exe
File created	C:\PROGRA~3\Mozilla\kfofaem.dll	cpuirzc.exe

C:\Users\Admin\AppData\Local\Temp\b601211381a0c078f6d7617cf8159350_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\b601211381a0c078f6d7617cf8159350_exe32.exe"
1⤵
- Drops file in Program Files directory
PID:3048

C:\PROGRA~3\Mozilla\cpuirzc.exe
C:\PROGRA~3\Mozilla\cpuirzc.exe -yyraenb
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\cpuirzc.exe

Filesize
200KB

MD5
4c2e929dd0fef91f368fd4a1fd15b6c2

SHA1
b6a84fafc9056238dbeaf55fd24e677f995ade98

SHA256
a888032759f270ce1d94b0f3f6bc46b197321c8d6945053d8e87ae50b43fcab8

SHA512
52d0ba6322299fda34bca6f725c735a50b0c7da86ef65ecd0c0c6a2b75813ca1af9eca8db06fd08325b2eacb0d582f300810ac50e1177d40c4b9f0270c37ea71

Download Submit
C:\ProgramData\Mozilla\cpuirzc.exe

Filesize
200KB

MD5
4c2e929dd0fef91f368fd4a1fd15b6c2

SHA1
b6a84fafc9056238dbeaf55fd24e677f995ade98

SHA256
a888032759f270ce1d94b0f3f6bc46b197321c8d6945053d8e87ae50b43fcab8

SHA512
52d0ba6322299fda34bca6f725c735a50b0c7da86ef65ecd0c0c6a2b75813ca1af9eca8db06fd08325b2eacb0d582f300810ac50e1177d40c4b9f0270c37ea71

Download Submit
memory/1964-13-0x0000000000720000-0x000000000077C000-memory.dmp

Filesize
368KB

Download
memory/1964-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1964-15-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1964-16-0x0000000000720000-0x000000000077C000-memory.dmp

Filesize
368KB

Download
memory/1964-18-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1964-21-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3048-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3048-5-0x0000000000A40000-0x0000000000A9C000-memory.dmp

Filesize
368KB

Download
memory/3048-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3048-2-0x0000000000A40000-0x0000000000A9C000-memory.dmp

Filesize
368KB

Download
memory/3048-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3048-1-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3048-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download