07c73711038e0d36aac6e557e2009b75511b1958e332d89e29b283347f2373b8

Analysis

max time kernel
34s
max time network
139s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 07:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

101ca0df13e8d04c6ed5151e2dea9d31.exe
Size

274KB
MD5

101ca0df13e8d04c6ed5151e2dea9d31
SHA1

d0f2507c6c9eaa9c9005cdaff2037f7cd66d9fca
SHA256

07c73711038e0d36aac6e557e2009b75511b1958e332d89e29b283347f2373b8
SHA512

60724aa0e019138bf3ae7bb677bb2d4d2ea80c91a491c4c8ce14013d61b7a6c87c5e14e8885f8023057d9bf41e8a3d8810ba1c893d29b72ad3ac59d233a3bef9
SSDEEP

6144:OEoFd1LTc4vEKO7iw3Gw3qkjcXKXYUSxteI:FoF/ZvvbEG5Ht

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2512	Favorite.exe

Loads dropped DLL 2 IoCs

pid	Process
2896	101ca0df13e8d04c6ed5151e2dea9d31.exe
2896	101ca0df13e8d04c6ed5151e2dea9d31.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2896-0-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/2512-12-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/2896-14-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/2512-15-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/2896-30-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/2512-32-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/2512-36-0x0000000000400000-0x00000000004A7000-memory.dmp	upx
behavioral1/memory/2512-40-0x0000000000400000-0x00000000004A7000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Favorite = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Favorite.exe"	Favorite.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2896	101ca0df13e8d04c6ed5151e2dea9d31.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2512	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	28
PID 2896 wrote to memory of 2512	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	28
PID 2896 wrote to memory of 2512	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	28
PID 2896 wrote to memory of 2512	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	28
PID 2896 wrote to memory of 2672	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	30
PID 2896 wrote to memory of 2672	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	30
PID 2896 wrote to memory of 2672	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	30
PID 2896 wrote to memory of 2672	2896	101ca0df13e8d04c6ed5151e2dea9d31.exe	30

C:\Users\Admin\AppData\Local\Temp\101ca0df13e8d04c6ed5151e2dea9d31.exe
"C:\Users\Admin\AppData\Local\Temp\101ca0df13e8d04c6ed5151e2dea9d31.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Users\Admin\AppData\Local\Temp\Favorite.exe
  C:\Users\Admin\AppData\Local\Temp\Favorite.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\deleteself.bat
  2⤵
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-15-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2512-40-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2512-13-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2512-12-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2512-36-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2512-32-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2896-14-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2896-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2896-16-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2896-19-0x0000000003760000-0x0000000003807000-memory.dmp

Filesize
668KB

Download
memory/2896-30-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download
memory/2896-10-0x0000000003760000-0x0000000003807000-memory.dmp

Filesize
668KB

Download
memory/2896-11-0x0000000003760000-0x0000000003807000-memory.dmp

Filesize
668KB

Download
memory/2896-0-0x0000000000400000-0x00000000004A7000-memory.dmp

Filesize
668KB

Download