Analysis

  • max time kernel
    0s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-12-2023 16:46

General

  • Target

    2e4a5ce2b41a1619fc0dffee26964162.exe

  • Size

    556KB

  • MD5

    2e4a5ce2b41a1619fc0dffee26964162

  • SHA1

    c9d9fdbdd61d5cd281ed577e954e52dbbc5f499b

  • SHA256

    e0f7d8aa33de49803aa306c87f5fd764c66deece40f6b4e795a8ed2afb583d90

  • SHA512

    b4786b79ac4d54eff59b97241bb127b3138ea1a137805fa61ad0bacba54a0d8430c9d9486591111f12ed5c2dbf1928307c83010cfa097760a9526ba33c198551

  • SSDEEP

    12288:yGMK5hQ5a9gLkEUtzQqxHQi274isouxNwH2DC9dW1m3AiiMMrb:yGj5hQ5uAkEmzvH674UuxNvC9dW1Fiir

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e4a5ce2b41a1619fc0dffee26964162.exe
    "C:\Users\Admin\AppData\Local\Temp\2e4a5ce2b41a1619fc0dffee26964162.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3020-1-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-27-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/3020-2-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-0-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-133-0x0000000002230000-0x0000000002240000-memory.dmp

    Filesize

    64KB

  • memory/3020-164-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-165-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-166-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-168-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/3020-167-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-169-0x0000000002230000-0x0000000002240000-memory.dmp

    Filesize

    64KB

  • memory/3020-170-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-171-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-172-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-174-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-175-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-176-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-177-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-178-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-179-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-180-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-181-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/3020-182-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB