11dd88fdb825e8c2872c8d89924279930e7decbc6c51d0394103b232594e534a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7963632ef2660af67adec7f8865a1d18.exe
Size

111KB
MD5

7963632ef2660af67adec7f8865a1d18
SHA1

923ade141cddd230f65d2f4ec2b1443c5401047c
SHA256

11dd88fdb825e8c2872c8d89924279930e7decbc6c51d0394103b232594e534a
SHA512

cb255877f3457d2cad60199e03022a0c51306a8f81d658b227d22692e5d6967cf3d66677cf6c9aec4e73af30830e46f52c501d986866bd6bf30c5f0106b1a707
SSDEEP

3072:EihdwOEiegApCK8xLO5WfKFVn/0eY/8fxXwLi9YU29ixaLL:ETO5AIU5W0ViCxXwLi9D29ixG

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1596	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2476-1-0x0000000000400000-0x0000000000447000-memory.dmp	upx
behavioral1/memory/2476-0-0x0000000000400000-0x0000000000447000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2476	7963632ef2660af67adec7f8865a1d18.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2476	7963632ef2660af67adec7f8865a1d18.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 1596	2476	7963632ef2660af67adec7f8865a1d18.exe	14
PID 2476 wrote to memory of 1596	2476	7963632ef2660af67adec7f8865a1d18.exe	14
PID 2476 wrote to memory of 1596	2476	7963632ef2660af67adec7f8865a1d18.exe	14
PID 2476 wrote to memory of 1596	2476	7963632ef2660af67adec7f8865a1d18.exe	14

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\796363~1.EXE > nul
1⤵
- Deletes itself
PID:1596

C:\Users\Admin\AppData\Local\Temp\7963632ef2660af67adec7f8865a1d18.exe
"C:\Users\Admin\AppData\Local\Temp\7963632ef2660af67adec7f8865a1d18.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-1-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2476-0-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download