436eec02188a1993d9e887ff8aa6a9b1f5947cec3ee4b77984a1fde9f26fbe17

Analysis

max time kernel
43s
max time network
26s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06998dc65e14d4d9935999f7485e8ab3.exe
Size

18KB
MD5

06998dc65e14d4d9935999f7485e8ab3
SHA1

cd4a069c373ba9765f7d0772c7827d73aac2d979
SHA256

436eec02188a1993d9e887ff8aa6a9b1f5947cec3ee4b77984a1fde9f26fbe17
SHA512

9ad61bd81bc75ccb31168c54f4491e4ba289952df9cc7f0e0b592fe9eaa8f579d05db598d704f35aa40a806a0b53b60e18437e797739c3c861e270971209baf5
SSDEEP

384:DetY+fEK7SnzOFRLg5g6BbZxRHdhf6dkptfWbw24uzqf+Yzufm2LVFm47U+2:iSnnz8RLHUr9hukvW0Wzszuu2LVFm47g

Score

7^/10

persistence upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2900	06998dc65e14d4d9935999f7485e8ab3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-0-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/2900-7-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\mfchlp32 = "C:\\Windows\\mfchlp32.exe"	06998dc65e14d4d9935999f7485e8ab3.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\mfchlp32.dll	06998dc65e14d4d9935999f7485e8ab3.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mfchlp32.exe	06998dc65e14d4d9935999f7485e8ab3.exe
File created	C:\Windows\mfchlp32.exe	06998dc65e14d4d9935999f7485e8ab3.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	06998dc65e14d4d9935999f7485e8ab3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	06998dc65e14d4d9935999f7485e8ab3.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1256	2900	06998dc65e14d4d9935999f7485e8ab3.exe	16
PID 2900 wrote to memory of 1256	2900	06998dc65e14d4d9935999f7485e8ab3.exe	16

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1256
- C:\Users\Admin\AppData\Local\Temp\06998dc65e14d4d9935999f7485e8ab3.exe
  "C:\Users\Admin\AppData\Local\Temp\06998dc65e14d4d9935999f7485e8ab3.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\mfchlp32.dll

Filesize
28KB

MD5
e11dbf783355929b84e54f72900e8e20

SHA1
c2882b7d0742c89e53c252b90276129f87b9e2c4

SHA256
c49d00855580151eeb94c2fa067a4c13c2680001090c74e99aa344a3718f0971

SHA512
9b9c6e5f45639e8b50fd2db75d40b87d4b75acf3029e95aff0f605527a9815fb42f726c1adefeb909718090c5b822d9d88d6e66b53c2a782e768e48aafb5227f

Download Submit
memory/1256-3-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/2900-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2900-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2900-8-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download