Analysis
-
max time kernel
138s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
18-11-2023 15:04
General
-
Target
ba9bec29269eeae11bd774bb9878698eefe9e5681ccb5e41faea08255c96403a.exe
-
Size
4.9MB
-
MD5
bef936e0f52f74471ed4f892c4aed4ed
-
SHA1
fdcab51035a4bef3767259e653d2e5bdca4fbaa3
-
SHA256
ba9bec29269eeae11bd774bb9878698eefe9e5681ccb5e41faea08255c96403a
-
SHA512
a9a3f15ea9725c4fa40f2426d3c90aa6811e1e8ba063e69dab31391a223862a5c245ca7db6948ba67f5e94357ee61e38f3ac215eb04dc0fbe54d561dc3eccad2
-
SSDEEP
98304:YdK+LNVmvsMdGcqWIkDwSqyJRPB2H6iuNMWUtzRi/BY6TDj:Y3D7MdwktlRQaz27i/G6Tv
Score
7/10
Malware Config
Signatures
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba9bec29269eeae11bd774bb9878698eefe9e5681ccb5e41faea08255c96403a.exe"C:\Users\Admin\AppData\Local\Temp\ba9bec29269eeae11bd774bb9878698eefe9e5681ccb5e41faea08255c96403a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 10482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2948 -ip 29481⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.3MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
8.3MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
8.3MB