c6e09cef2032cce984524f7d4a7f8f2be2ac1400fab76b573e2a11db05a1d440

Analysis

max time kernel
0s
max time network
11s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 05:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0739df9e8d9b1c78a382ade3e651dc7f.exe
Size

47KB
MD5

0739df9e8d9b1c78a382ade3e651dc7f
SHA1

4f5acbe4b10ef6f52af407293d7e1bff891645fe
SHA256

c6e09cef2032cce984524f7d4a7f8f2be2ac1400fab76b573e2a11db05a1d440
SHA512

b22411ea472e248910de0a44e05ac392de871a5603c29dbb96d66c82900dfff996d4f8aaed580cc9f344fae5b35b63e2db6c795cf39e5ee2a7c10db4f80991d3
SSDEEP

768:FLvgkV7aiQyK86OXBvf34i/oKYkw3+X2fLaxeKDm+AnZ35Bn5E0YOzYp6ibDlF:pJtQa6OX9fb/PY7M2zIm+uN57tsZZ

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1848-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2244	reg.exe

C:\Windows\SysWOW64\shutdown.exe
"C:\Windows\System32\shutdown.exe" /r /t 6 /f
1⤵
PID:2628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2342910900 /d "C:\Users\Admin\2342910900\2342910900.exe" /F
1⤵
PID:2864
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2342910900 /d "C:\Users\Admin\2342910900\2342910900.exe" /F
  2⤵
  - Modifies registry key
  PID:2244

C:\Users\Admin\AppData\Local\Temp\0739df9e8d9b1c78a382ade3e651dc7f.exe
"C:\Users\Admin\AppData\Local\Temp\0739df9e8d9b1c78a382ade3e651dc7f.exe"
1⤵
PID:1848

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2368

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1848-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1848-1-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2368-3-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/2556-4-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Filesize
4KB

Download