29709c7360de87796df3247a3a06f572f00d3fd4e61a92c3a09f323eb3b72c1f

Analysis

max time kernel
195s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

187f77d23681fe93abf0edc09f1691af.exe
Size

420KB
MD5

187f77d23681fe93abf0edc09f1691af
SHA1

f5528092bcb6308174e727e9d0cb8517a1617b56
SHA256

29709c7360de87796df3247a3a06f572f00d3fd4e61a92c3a09f323eb3b72c1f
SHA512

3609f98ba2366569d3321dd8ad382f716ef03c59b90574aad03dc2c58c5e3582cde7dbb9c46f02809b1f7ac55f8e9bf116609adfc60c4f11f6206c1849a40f35
SSDEEP

12288:2waA3t7VPRw+8cOSQN2jyGFyFjISvfsJJa/oSd8:Jpbw+8cze/jL4U78

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4896-0-0x0000000000400000-0x0000000000602000-memory.dmp	upx
behavioral2/memory/4896-21-0x0000000000400000-0x0000000000602000-memory.dmp	upx
behavioral2/memory/4896-40-0x0000000000400000-0x0000000000602000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4896	187f77d23681fe93abf0edc09f1691af.exe
4896	187f77d23681fe93abf0edc09f1691af.exe
4896	187f77d23681fe93abf0edc09f1691af.exe
4896	187f77d23681fe93abf0edc09f1691af.exe

C:\Users\Admin\AppData\Local\Temp\187f77d23681fe93abf0edc09f1691af.exe
"C:\Users\Admin\AppData\Local\Temp\187f77d23681fe93abf0edc09f1691af.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\GetRightToGo\187f77d23681fe93abf0edc09f1691af.data

Filesize
813B

MD5
d0fc75a5b213e72d93dd0a946d595e31

SHA1
359010cd6f35f1e438365222d004c1bae406e95e

SHA256
57d9f1bcc0c254e5d6a17897aafaf478c348c0051d51b33d3d20bad8b452d761

SHA512
0a245304c0a768c3d9c4f79ffa401c20bacf13d8da5197fa4b07d7d3ff5580deb308b74e77419cfa367bc5af938d719ee2dde9e33b767bc74a91d5a4105870e7

Download Submit
C:\Users\Admin\AppData\Roaming\GetRightToGo\187f77d23681fe93abf0edc09f1691af.htm

Filesize
87KB

MD5
2290e78ddaffaa73838e9a67d679cbc7

SHA1
5e2583a2c5bad107c82cab2a495d559e1385ae41

SHA256
ca6005b88259d61bfc9943b1236cd4f6f12833f3134a3c1553545247d95aca2d

SHA512
a2c6ae503b264e30925c685efb6389175138fb809989d5e4c61e62345662c0d7a6e0de57c6a8f883209c7bf613c6be3fb4ca2031876d562271c8b111ad338abc

Download Submit
memory/4896-0-0x0000000000400000-0x0000000000602000-memory.dmp

Filesize
2.0MB

Download
memory/4896-21-0x0000000000400000-0x0000000000602000-memory.dmp

Filesize
2.0MB

Download
memory/4896-40-0x0000000000400000-0x0000000000602000-memory.dmp

Filesize
2.0MB

Download