3df3bd8b9a907df22565c603aa4570e2d78e52c1f06b427f8d69edcd153711f6

Analysis

max time kernel
132s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 06:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

10fa1f2f99a968ef681e2c0c5b42e02a.exe
Size

200KB
MD5

10fa1f2f99a968ef681e2c0c5b42e02a
SHA1

c3afe5b4bf177067bd3332bfc1193ab3aa878396
SHA256

3df3bd8b9a907df22565c603aa4570e2d78e52c1f06b427f8d69edcd153711f6
SHA512

4552ae6a564284a65b14d8fc2eeea9a46b869a108148858514687971dd2d80df20cdd5ade38daf2729a1d7cf6d280a45409ca0b40e5c8e6aa2b6d1513fdcf238
SSDEEP

3072:eGYjnZJ7YtG1jxrWrI1091xUTnPQkFAf6PvQlDZ7VXNz+Uen0PkfpQEkybB2:ujn/7Yo1jx0n1a8kmKQlpNVJhybB

Score

7^/10

upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2144	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-0-0x0000000000400000-0x0000000000446000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2156 set thread context of 2144	2156	10fa1f2f99a968ef681e2c0c5b42e02a.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}\u = "15"	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}\cid = "533219210953261032"	explorer.exe
Key created	\registry\machine\Software\Classes\Interface\{c96b3a43-c658-568e-e4a7-36c2600cc942}	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2144	2156	10fa1f2f99a968ef681e2c0c5b42e02a.exe	28
PID 2156 wrote to memory of 2144	2156	10fa1f2f99a968ef681e2c0c5b42e02a.exe	28
PID 2156 wrote to memory of 2144	2156	10fa1f2f99a968ef681e2c0c5b42e02a.exe	28
PID 2156 wrote to memory of 2144	2156	10fa1f2f99a968ef681e2c0c5b42e02a.exe	28
PID 2156 wrote to memory of 2144	2156	10fa1f2f99a968ef681e2c0c5b42e02a.exe	28
PID 2144 wrote to memory of 336	2144	explorer.exe	4
PID 336 wrote to memory of 2880	336	csrss.exe	29
PID 336 wrote to memory of 2880	336	csrss.exe	29
PID 336 wrote to memory of 2584	336	csrss.exe	30
PID 336 wrote to memory of 2584	336	csrss.exe	30

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Users\Admin\AppData\Local\Temp\10fa1f2f99a968ef681e2c0c5b42e02a.exe
"C:\Users\Admin\AppData\Local\Temp\10fa1f2f99a968ef681e2c0c5b42e02a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\explorer.exe
  00000058*
  2⤵
  - Deletes itself
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2144

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2880

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\consrv.dll

Filesize
31KB

MD5
efc97d330e6295de859b06f661390a6d

SHA1
740699a8b7f1db27829f3fbf41f1ab6120478315

SHA256
8a6d6406969a8e332a8088e75b8c8cd4ea37277be4e03ee3d7dfbd73cdc5fa3a

SHA512
f7d3cc7946ea15271a4852fd64f7e98260f7a90598fae73de7727c3eb77ad966a2b9cee0d06aa8b2d964c2aa49525522841ab5c1d9a6fc0190e6ae3631407ba4

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
79ca051e5653c809f998f6db0aa3536d

SHA1
4e2166dd762334e2102550dbcc141397e47d0ebd

SHA256
263afe69af9459a6ee9363b316356160464b353159f040431809a26170aa06b6

SHA512
0218b66a67000f7b2d482d7ee3bffaced17944ac4a1702e5f9cf9384379f82a940dcd8c7af8d22cc2105c443e5207a256ad7387859ef6e54b51ba2ac66409850

Download Submit
memory/336-19-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/336-20-0x0000000000820000-0x000000000082C000-memory.dmp

Filesize
48KB

Download
memory/2144-3-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/2144-4-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download
memory/2144-9-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/2144-14-0x0000000000130000-0x0000000000144000-memory.dmp

Filesize
80KB

Download
memory/2156-0-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2156-1-0x00000000001C0000-0x00000000001D4000-memory.dmp

Filesize
80KB

Download
memory/2156-2-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download