Analysis

  • max time kernel
    142s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 05:04

General

  • Target

    06afb466fae7e2eb3f60aa8f4e2a44bb.exe

  • Size

    423KB

  • MD5

    06afb466fae7e2eb3f60aa8f4e2a44bb

  • SHA1

    0b30bc05beb8e2121c2f65fa29ab3a2c02183ace

  • SHA256

    7681bebff386f18f22554d8e44aca7581e38a9ef6405b84b76eeed34d6f1c267

  • SHA512

    37d092d464231c55cab229548c20c0196ccb67d9ea8fe8825aa6354ab5a38eb8896d50081b5137ead7840b80e7015ea84191adffc5f39840bdd7c92b66a802b3

  • SSDEEP

    12288:bwaA3t7VPRw+8cOSQN2jyGFyFjISvfsJJa/oSdw:kpbw+8cze/jL4U7w

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06afb466fae7e2eb3f60aa8f4e2a44bb.exe
    "C:\Users\Admin\AppData\Local\Temp\06afb466fae7e2eb3f60aa8f4e2a44bb.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:2024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6a8a44aec06f5cf61219b3f53e0316fe

    SHA1

    dd67e9931304c3778c4ce2eebaa2ba431a500f3a

    SHA256

    89ba9481c22af7bc03baf430868bcbfd9cdb82eb2cfde3984f64cb278a0eddd1

    SHA512

    6fd0c4373e2fa9b4e3def6e380545df9a4591f5ba0449c1f842ee2813fb3ef9bfc5d8b0080e322e63baa1820da00a2b96975dfb907152ad2d1bb845660a12d81

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6fb9430c70ff6d4d65bc7f3967b54dde

    SHA1

    11f9ae6f70c14bb362b12d9f9f4c41bbf37940c6

    SHA256

    9480b92881ef5d746759382185ea90bcfe860efe5323ae8f8679a335ca6f0c53

    SHA512

    4bbf2fe06ce72f8d90ee174cb06a3508f79a1a1acc0654665b0f9cbb798d2a1f84d79a58bd3bc60b22cb05353b78a25500e53938fe968baaf7aed737cd5955d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    358f7f45b54905e061c8e403448209a6

    SHA1

    d28e9c5716f3c709665abf29a0a744f2d2eadba2

    SHA256

    0eeb78b8b845e56579530aab8693fad89c677d47fe6f28e35489a0375e229bf2

    SHA512

    dc7449095f70b4c87fc38f949439e3f11af7b1293c0f7084f9a1efcd9e77e798bcbe7e12c174f7f2f6def773d67108b9739a300fc004e59dae77e496af5ff3e2

  • C:\Users\Admin\AppData\Local\Temp\Cab5073.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar5121.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Roaming\GetRightToGo\06afb466fae7e2eb3f60aa8f4e2a44bb.data0

    Filesize

    812B

    MD5

    93657739e2a4ada79d91b04b8fb320bc

    SHA1

    3d2171c8df163c3f2f719c6d2de9b4db1fa3bc09

    SHA256

    d4e438844bd4d46a747b82cc3e8dc8d8cae63484e14088cbb6605b807bfe7647

    SHA512

    24bf3cfd5119a73790a7851a08884a9c7a4dea391efe292e8f984cfe2e0d0a5d8e729e178fb0762156ec750e5b3f3679ecbf170d52ef984818f1a4e56c458f51

  • C:\Users\Admin\AppData\Roaming\GetRightToGo\06afb466fae7e2eb3f60aa8f4e2a44bb.htm

    Filesize

    87KB

    MD5

    2290e78ddaffaa73838e9a67d679cbc7

    SHA1

    5e2583a2c5bad107c82cab2a495d559e1385ae41

    SHA256

    ca6005b88259d61bfc9943b1236cd4f6f12833f3134a3c1553545247d95aca2d

    SHA512

    a2c6ae503b264e30925c685efb6389175138fb809989d5e4c61e62345662c0d7a6e0de57c6a8f883209c7bf613c6be3fb4ca2031876d562271c8b111ad338abc

  • memory/2024-0-0x0000000000400000-0x0000000000602000-memory.dmp

    Filesize

    2.0MB

  • memory/2024-136-0x0000000000400000-0x0000000000602000-memory.dmp

    Filesize

    2.0MB