63f09accec72a4d5686cf07c6a935738b1d5a444aff58eb90463de7f6c768ce4

Analysis

max time kernel
141s
max time network
129s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31/10/2023, 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

189e1588268d51b7fb6e8633ec8f6ba82d5720979f14dbbfe59cac1b8be1b34b.exe
Size

199KB
MD5

628fe475aaf6bcefb801dd4a01135a0c
SHA1

d306b7b345723cd8b930135801801fff5494e57d
SHA256

189e1588268d51b7fb6e8633ec8f6ba82d5720979f14dbbfe59cac1b8be1b34b
SHA512

2aa87c5fe05a7994993f142fec6496f95adfd088a852912ed5dbbc3cc48c798d91bc022bc0a413df29a0a32928e2e6cf8ceab9a89985e09b482271b528e6f3e2
SSDEEP

3072:MehcJW9PQtBmplfIRRPZ5Sy1240NLPVayl/bJFb2QCpjvZI8esxQtiXZktQ:3qUUAfwPZ5VAbTJqFNZNHxpXat

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2692-0-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral1/memory/2692-2-0x0000000000400000-0x000000000048E000-memory.dmp	upx

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	189e1588268d51b7fb6e8633ec8f6ba82d5720979f14dbbfe59cac1b8be1b34b.exe
File opened (read-only)	\??\B:	189e1588268d51b7fb6e8633ec8f6ba82d5720979f14dbbfe59cac1b8be1b34b.exe

C:\Users\Admin\AppData\Local\Temp\189e1588268d51b7fb6e8633ec8f6ba82d5720979f14dbbfe59cac1b8be1b34b.exe
"C:\Users\Admin\AppData\Local\Temp\189e1588268d51b7fb6e8633ec8f6ba82d5720979f14dbbfe59cac1b8be1b34b.exe"
1⤵
- Enumerates connected drives
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2692-0-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2692-1-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2692-2-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2692-4-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download