5bd108d61e349428a3ab73d6cb3e559e70363d165828628dd1be6e8f773089df

Analysis

max time kernel
0s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b7606f375a8ed8909d7543599517e65.exe
Size

550KB
MD5

4b7606f375a8ed8909d7543599517e65
SHA1

400ce8e4b26ceed4d4dd0760c94a4a12c407127c
SHA256

5bd108d61e349428a3ab73d6cb3e559e70363d165828628dd1be6e8f773089df
SHA512

2123909c3bc254c70329bb55810917232ac281ff098fe4830581c1d0ec1a4ed95b65da99a852dae23ae5f804d8940884961bcf70e9b01d5b701804d665afc7f1
SSDEEP

12288:woHe9W0+Icx+EDwCnAaeT5VH45nxZ2TOL3nIHEhsIlQ9JAfN01XAr5MMBh:7e9W0ExrDf56Sym3AE20SAfgQr5MMBh

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/456-0-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-2-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-1-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-157-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-158-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-160-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-159-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-162-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-163-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-164-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-166-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-167-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-168-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/456-169-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
456	4b7606f375a8ed8909d7543599517e65.exe
456	4b7606f375a8ed8909d7543599517e65.exe

C:\Users\Admin\AppData\Local\Temp\4b7606f375a8ed8909d7543599517e65.exe
"C:\Users\Admin\AppData\Local\Temp\4b7606f375a8ed8909d7543599517e65.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-2-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-3-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/456-1-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-157-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-158-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-160-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-159-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-161-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/456-162-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-163-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-164-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-166-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-167-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-168-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-169-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-170-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-171-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-172-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-173-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/456-174-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download