e5979e79356d4cf6a1e1e4197c422fa410ff8e265e1ec1d78f5e32eb915b8531

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0677620ffa0c52e48cfaf1b0e63eacee.exe
Size

380KB
MD5

0677620ffa0c52e48cfaf1b0e63eacee
SHA1

7054826ce03d86a203b08bba41a9dcb0b031b140
SHA256

e5979e79356d4cf6a1e1e4197c422fa410ff8e265e1ec1d78f5e32eb915b8531
SHA512

9a8b154b0017685612dddf753f554f4039164b44cb9fdcf0bca940379c56f55155ab9a116ed946294e3ddc3dcd395d051c0eb5a0725e4c6289203449e56aec29
SSDEEP

6144:vhgCGGGo+vFFb9xNmqnVu/FeobNjxGv4IGWTL94UY6oWk8XONMFF2nga3B34mjWv:JeFFJSqnVsFTX7IJHCVWuNMFgb14UWim

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x0000000000400000-0x0000000000542000-memory.dmp	upx
behavioral1/memory/2860-1-0x0000000000400000-0x0000000000542000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\0677620ffa0c52e48cfaf1b0e63eacee.exe
"C:\Users\Admin\AppData\Local\Temp\0677620ffa0c52e48cfaf1b0e63eacee.exe"
1⤵
PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2860-0-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/2860-1-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download