6202dcf599f3d7131b7ac81daffcfff1ff8ff391e6a0ada2080962a4873a1d55

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d4949b7250532127dadbebe181f2b3b.exe
Size

65KB
MD5

2d4949b7250532127dadbebe181f2b3b
SHA1

3ae7d7a7b3fdfcbea83b0b81b7f1dd690a7bc907
SHA256

6202dcf599f3d7131b7ac81daffcfff1ff8ff391e6a0ada2080962a4873a1d55
SHA512

7bbfb9f0b9407a50fd19fd7c41c6a34978f0cd2c36212de8013fc7cc2840df49384db54a28321d92f185cb20fed9fba08c22901c8ec560ebdd0b0486ac0e7564
SSDEEP

1536:n87wc1aGNC0klI7CPpIFa6odcmBWqYGd5cn7nGw:87wc1aOCo7CxIsdcmrmn7Gw

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4204-0-0x0000000000800000-0x000000000080D000-memory.dmp	upx
behavioral2/memory/4204-3-0x0000000000800000-0x000000000080D000-memory.dmp	upx
behavioral2/files/0x0007000000023212-7.dat	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Traybar = "C:\\Windows\\lsass.exe"	2d4949b7250532127dadbebe181f2b3b.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pt-BR\Harry Potter.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\index.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\Harry Potter.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\index.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\FREN\Harry Potter.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\Kazaa Lite.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BC511AE6-709C-4371-BC56-72ECE237F064\root\WinRAR.v.3.2.and.key.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\ICQ 4 Lite.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\WinRAR.v.3.2.and.key.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Winamp 5.0 (en) Crack.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\index.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\ICQ 4 Lite.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\Winamp 5.0 (en) Crack.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\Winamp 5.0 (en) Crack.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\Kazaa Lite.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\WinRAR.v.3.2.and.key.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BC511AE6-709C-4371-BC56-72ECE237F064\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\13.0.0.0__89845DCD8080CC91\Winamp 5.0 (en) Crack.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Kazaa Lite.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\Harry Potter.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\Winamp 5.0 (en).exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\Winamp 5.0 (en) Crack.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\Winamp 5.0 (en).exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\BC511AE6-709C-4371-BC56-72ECE237F064\root\vfs\Windows\assembly\GAC_MSIL\Microsoft.AnalysisServices.SPClient.Interfaces\ICQ 4 Lite.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\ICQ 4 Lite.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\Winamp 5.0 (en).ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\PlatformCapabilities\Kazaa Lite.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\index.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Kazaa Lite.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\WinRAR.v.3.2.and.key.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\QUAD\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\ENFR\WinRAR.v.3.2.and.key.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\1033\Winamp 5.0 (en) Crack.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\Winamp 5.0 (en).ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\WinRAR.v.3.2.and.key.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\Winamp 5.0 (en).exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\Winamp 5.0 (en).com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Harry Potter.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\Winamp 5.0 (en).ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\Harry Potter.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\index.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\Winamp 5.0 (en) Crack.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Kazaa Lite.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\Kazaa Lite.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\Kazaa Lite.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Winamp 5.0 (en).com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\WinRAR.v.3.2.and.key.ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\Winamp 5.0 (en).exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\Winamp 5.0 (en).exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\et-EE\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\index.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\ICQ 4 Lite.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\Winamp 5.0 (en).ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\Winamp 5.0 (en).ShareReactor.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\Winamp 5.0 (en) Crack.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\Winamp 5.0 (en) Crack.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\ICQ 4 Lite.com	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\Winamp 5.0 (en).exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\ICQ 4 Lite.com	2d4949b7250532127dadbebe181f2b3b.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\lsass.exe	2d4949b7250532127dadbebe181f2b3b.exe
File created	C:\Windows\lsass.exe	2d4949b7250532127dadbebe181f2b3b.exe

C:\Users\Admin\AppData\Local\Temp\2d4949b7250532127dadbebe181f2b3b.exe
"C:\Users\Admin\AppData\Local\Temp\2d4949b7250532127dadbebe181f2b3b.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\Kazaa Lite.com

Filesize
65KB

MD5
2d4949b7250532127dadbebe181f2b3b

SHA1
3ae7d7a7b3fdfcbea83b0b81b7f1dd690a7bc907

SHA256
6202dcf599f3d7131b7ac81daffcfff1ff8ff391e6a0ada2080962a4873a1d55

SHA512
7bbfb9f0b9407a50fd19fd7c41c6a34978f0cd2c36212de8013fc7cc2840df49384db54a28321d92f185cb20fed9fba08c22901c8ec560ebdd0b0486ac0e7564

Download Submit
memory/4204-0-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download
memory/4204-3-0x0000000000800000-0x000000000080D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads