Overview

overview

7

Static

static

7

142c97e330...70.exe

windows7-x64

7

142c97e330...70.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    157s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2023, 11:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    142c97e3309f96d734f83d5669005670.exe

  • Size

    405KB

  • MD5

    142c97e3309f96d734f83d5669005670

  • SHA1

    ab5b9c8bcc86efd2d39674e2b7025ae8f4a4fe5e

  • SHA256

    280c24a73764a85c57dc7a1ff2b30dc378923dad5c84c413c85751d7bde2c037

  • SHA512

    db64bbb0297fd53b19ea1c6560a75ca64059189db0a208781d76c5a140e6c2fefbad087b84b4df994d47c2d201eaee99c6237f63b64ab081d377940485610d40

  • SSDEEP

    6144:OEcvV4Fustn8MnUI8/wkkqxkEpiMkR9ve/wwxxkl:OBV4FustW4kkbEpiMk3ve46Wl

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\142c97e3309f96d734f83d5669005670.exe
    "C:\Users\Admin\AppData\Local\Temp\142c97e3309f96d734f83d5669005670.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\Sysceamfwire.exe
      "C:\Users\Admin\AppData\Local\Temp\Sysceamfwire.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Sysceamfwire.exe
    Filesize

    405KB

    MD5

    3335a5fc0bc899656cf8f8eed54e74cb

    SHA1

    72469df91a7dd96394f386f147b7a1a5e477bc9a

    SHA256

    ca0b1822c1bdbe0b1c5b20337b8f107b1d28594ed1191128928bc039c6094c13

    SHA512

    4ea9efcbf6cf5a38d56b4ddf56bd67ac7bb0a342c615dfc855b2ab8128b8fac4f78c36441ef5def789e52b9bca0586405683e81d065f46dde3bff11e0f3e4512

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\cpath.ini
    Filesize

    70B

    MD5

    589533fdcf5f836dfbc86b4b68a6c080

    SHA1

    971ebe7a0080190964fc574886a0e3947952c13b

    SHA256

    f6def41913e4ef793d96a1fa664d15f279371f7593b104954dde17b1f204f16d

    SHA512

    c44338e58bf295540102fef7d4e20b1da528140ac8b618a49777c34ad6628e9d106ea90a9336ad4d7af7bccf8ebbe77bf24da40f80929a7b39e36cb4f6b292a4

    Download Submit

  • memory/1644-42-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1684-0-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download

  • memory/1684-41-0x0000000000400000-0x0000000000468000-memory.dmp

    Filesize

    416KB

    Download