651a448f6241340003d77cd7eb79ed40c80d92e8a400111c041e5960056c44dc

Analysis

max time kernel
0s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 16:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0fac753f9d13b83d98582b7feb00753.exe
Size

1.1MB
MD5

f0fac753f9d13b83d98582b7feb00753
SHA1

4bcb4f665b634d4c2bf73ddc334efd0477f69321
SHA256

651a448f6241340003d77cd7eb79ed40c80d92e8a400111c041e5960056c44dc
SHA512

7b8193ef66315648e8ac48137cd2c8c4a14430d3553419a37f503ce584f6b5fde898c66cf6289ede8462d22a4da73889dfc88e9bf43bda1d918f5ec91d179bc3
SSDEEP

24576:2D3euKmLCkWZ/bRfcHTrlQzSraIKu78ThO3pEUaUTV4s:I3+pFVbRUHXLaI8KaUT

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1336-0-0x0000000000400000-0x000000000049E000-memory.dmp	upx
behavioral1/memory/1336-177-0x0000000000400000-0x000000000049E000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1336-177-0x0000000000400000-0x000000000049E000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
348	PING.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2232	1336	f0fac753f9d13b83d98582b7feb00753.exe	17
PID 1336 wrote to memory of 2232	1336	f0fac753f9d13b83d98582b7feb00753.exe	17
PID 1336 wrote to memory of 2232	1336	f0fac753f9d13b83d98582b7feb00753.exe	17
PID 1336 wrote to memory of 2232	1336	f0fac753f9d13b83d98582b7feb00753.exe	17

C:\Users\Admin\AppData\Local\Temp\f0fac753f9d13b83d98582b7feb00753.exe
"C:\Users\Admin\AppData\Local\Temp\f0fac753f9d13b83d98582b7feb00753.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.2127.cn/?newth3
  2⤵
  PID:2232
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
    3⤵
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ping 127.0.0.1 -n 3&del/q/s "C:\Users\Admin\AppData\Local\Temp\f0fac753f9d13b83d98582b7feb00753.exe"
  2⤵
  PID:540
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - Runs ping.exe
    PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TheWorld3\2\【卓越特价商城】.url

Filesize
194B

MD5
9018fcca1506b6e9998cf9483068765d

SHA1
ca7297f37507501b783b9384597b95f7a77e2602

SHA256
6589fb51a3d3c0128ba11a27383ef8f4f4a76d87e343a022555e1b8c63b76de4

SHA512
0811dd3febb468711702e15a32ced2f1bc29441cde1232f3f02f2c6f8e973aa550b32ebd0e097e3d9bd703e7774ab838daef9e126369ab7f4e23ac8613f2fdab

Download Submit
memory/1336-0-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download
memory/1336-177-0x0000000000400000-0x000000000049E000-memory.dmp

Filesize
632KB

Download