e33647411f96a47751a54598dffa1e91cdea0a76aa5d7db4e6fb8ed0bc9b6bbb

Analysis

max time kernel
44s
max time network
45s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 09:41

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

64841ebef17b183b9b3c5b4bdb0d819b.exe
Size

333KB
MD5

64841ebef17b183b9b3c5b4bdb0d819b
SHA1

0e575c10c0f4fe51fe3c0776c92decfd657a73d8
SHA256

e33647411f96a47751a54598dffa1e91cdea0a76aa5d7db4e6fb8ed0bc9b6bbb
SHA512

875ed63224601d00cc3c8f6fdb4c2788e2053de451f2450b9841c96f435676f8b231968db6d04f9cbc4bec40f1937b10a6fe267f48030745c9ee325e8be97868
SSDEEP

6144:L6AaKWS4DJdRz7ufx3ZQw4tXwUZJ1fLOfFmXBt0u8V4v:O5K7uRz7ulEfJJifec4v

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	FACK.exe

Loads dropped DLL 2 IoCs

pid	Process
1140	64841ebef17b183b9b3c5b4bdb0d819b.exe
1140	64841ebef17b183b9b3c5b4bdb0d819b.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1140-0-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/files/0x000b00000001223f-4.dat	upx
behavioral1/memory/1140-6-0x0000000002540000-0x00000000025FA000-memory.dmp	upx
behavioral1/memory/2844-9-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1140-10-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/1140-17-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral1/memory/2844-18-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/2844-20-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2844-18-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe
behavioral1/memory/2844-20-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FACK.exe	64841ebef17b183b9b3c5b4bdb0d819b.exe
File opened for modification	C:\Program Files (x86)\FACK.exe	64841ebef17b183b9b3c5b4bdb0d819b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2844	FACK.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2844	FACK.exe
2844	FACK.exe
2844	FACK.exe
2844	FACK.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
2844	FACK.exe
2844	FACK.exe
2844	FACK.exe
2844	FACK.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2844	1140	64841ebef17b183b9b3c5b4bdb0d819b.exe	28
PID 1140 wrote to memory of 2844	1140	64841ebef17b183b9b3c5b4bdb0d819b.exe	28
PID 1140 wrote to memory of 2844	1140	64841ebef17b183b9b3c5b4bdb0d819b.exe	28
PID 1140 wrote to memory of 2844	1140	64841ebef17b183b9b3c5b4bdb0d819b.exe	28

C:\Users\Admin\AppData\Local\Temp\64841ebef17b183b9b3c5b4bdb0d819b.exe
"C:\Users\Admin\AppData\Local\Temp\64841ebef17b183b9b3c5b4bdb0d819b.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\FACK.exe
  "C:\Program Files (x86)\FACK.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2844

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2588

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\FACK.exe

Filesize
285KB

MD5
e594b20d3cb5cd34a5f56c407614e61f

SHA1
8788e752dafdefd011c8e31e574152738f08e025

SHA256
e591c27a685e4c55a4bb9982e41ecda9fc44a4f04863eb701bcf5d64bf192b49

SHA512
25d4da74db0be8b658a1c7962cc3ee5c7b5d0ba90ce5bfce0691e693f199fb19232ef4c1c829445a8a7dc48e4feb53a4a5462d3bbf2e5fad4caf5d2b819e0cf3

Download Submit
memory/1140-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1140-6-0x0000000002540000-0x00000000025FA000-memory.dmp

Filesize
744KB

Download
memory/1140-10-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1140-14-0x0000000002680000-0x0000000002690000-memory.dmp

Filesize
64KB

Download
memory/1140-17-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1736-22-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2588-21-0x0000000002A40000-0x0000000002A41000-memory.dmp

Filesize
4KB

Download
memory/2844-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2844-18-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2844-20-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download