665e768962166d5fc34a265d99789145a91a62d6023065313af95c8ac5f3c2cd

Analysis

max time kernel
0s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5cd6eb6b02494d9264a1b0298a051616.exe
Size

585KB
MD5

5cd6eb6b02494d9264a1b0298a051616
SHA1

b802a27af5871263e88a29f25d80b3ce00b72b1b
SHA256

665e768962166d5fc34a265d99789145a91a62d6023065313af95c8ac5f3c2cd
SHA512

854639be57f41a424ed3306ff2de8256332cfe90a03e020114852cfdca82d128d240d4aaf95c87f0e723a9a3daa38a130bcd1b11359d98f5ad29c3e1a73b34cb
SSDEEP

12288:4CmsgvD4TcUTxBEOBX05vNnyL+VKrkluuzx7dlmJ8M2:piDAg805vNborkluSdU12

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3516-0-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-2-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-1-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-141-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-142-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-144-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-143-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-146-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/3516-147-0x0000000000400000-0x0000000000521000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3516	5cd6eb6b02494d9264a1b0298a051616.exe
3516	5cd6eb6b02494d9264a1b0298a051616.exe

C:\Users\Admin\AppData\Local\Temp\5cd6eb6b02494d9264a1b0298a051616.exe
"C:\Users\Admin\AppData\Local\Temp\5cd6eb6b02494d9264a1b0298a051616.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3516-0-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-2-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-1-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-3-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3516-141-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-142-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-144-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-143-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-145-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3516-146-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-147-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-148-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-150-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-151-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-152-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-153-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-154-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-155-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-156-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-157-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/3516-158-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download