Analysis

  • max time kernel
    0s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 15:35

General

  • Target

    29b9922cdaa7849cdfd0ae9463794344.exe

  • Size

    548KB

  • MD5

    29b9922cdaa7849cdfd0ae9463794344

  • SHA1

    8f053baf26d64bc16c4c2800973b5e4e97ef4d9d

  • SHA256

    ecbd89a88b540e99fdbc3c832937f8f86eb8c25eb96c667ab78799f059dfec06

  • SHA512

    f32efb98b11109afb22319042bfbb150043bcc1cb8216396d7466edf9dbf763ad3c156b697a7b321e5a6532b1a87741b02c0180fee1ea163346b71a7e581dd56

  • SSDEEP

    12288:JxX++BwqGOf7rqk9bebGr0ur+QRGaQGvOS4iC0Xi1tGTgQvzPMEMMyr:J9+tsfd9bEGr77YXEm0OtrQvzUEMMyr

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29b9922cdaa7849cdfd0ae9463794344.exe
    "C:\Users\Admin\AppData\Local\Temp\29b9922cdaa7849cdfd0ae9463794344.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1668

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1668-1-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-3-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/1668-2-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-0-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-134-0x0000000002180000-0x0000000002190000-memory.dmp

          Filesize

          64KB

        • memory/1668-164-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-165-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-167-0x0000000000230000-0x0000000000231000-memory.dmp

          Filesize

          4KB

        • memory/1668-166-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-168-0x0000000002180000-0x0000000002190000-memory.dmp

          Filesize

          64KB

        • memory/1668-169-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-170-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-171-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-173-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-174-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-175-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-176-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-177-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-178-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB

        • memory/1668-180-0x0000000002180000-0x0000000002185000-memory.dmp

          Filesize

          20KB

        • memory/1668-179-0x0000000000400000-0x000000000051C000-memory.dmp

          Filesize

          1.1MB