19d0f249e30903f9eafbb9de80f9ea52dc0a16f93339c0ee99a397230b2b8189

Analysis

max time kernel
148s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12cecd00181724148ea8fd1dd6c3ef7c.exe
Size

955KB
MD5

12cecd00181724148ea8fd1dd6c3ef7c
SHA1

3d27bdce20ccbd794b57fb17ba5e9efb57dada92
SHA256

19d0f249e30903f9eafbb9de80f9ea52dc0a16f93339c0ee99a397230b2b8189
SHA512

9911a90e892b8181b6eefa4c765a57b76c6574e718f4df375d4e85f929f943ce75cdafa439f143b07e77b263ede7a4b5855e4e5d79b00320e81aa8331d4d01a7
SSDEEP

12288:rbpHYUKy5U1bo9t8DMRSW9vbciUiLuAvOxMt11i27QitjI:r5sJo6YrFUiyAak11LtjI

Score

7^/10

persistence upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	svchest000.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3008-0-0x0000000000400000-0x0000000000597000-memory.dmp	upx
behavioral1/memory/3008-1-0x0000000000400000-0x0000000000597000-memory.dmp	upx
behavioral1/memory/2752-13-0x0000000000400000-0x0000000000597000-memory.dmp	upx
behavioral1/memory/2752-10-0x0000000000400000-0x0000000000597000-memory.dmp	upx
behavioral1/memory/2752-9-0x0000000000400000-0x0000000000597000-memory.dmp	upx
behavioral1/memory/3008-14-0x0000000000400000-0x0000000000597000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kris = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12cecd00181724148ea8fd1dd6c3ef7c.exe"	12cecd00181724148ea8fd1dd6c3ef7c.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3008	12cecd00181724148ea8fd1dd6c3ef7c.exe
2752	svchest000.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\Windows\BJ.exe	12cecd00181724148ea8fd1dd6c3ef7c.exe
File created	\??\c:\Windows\BJ.exe	12cecd00181724148ea8fd1dd6c3ef7c.exe
File created	\??\c:\Windows\svchest000.exe	12cecd00181724148ea8fd1dd6c3ef7c.exe
File opened for modification	\??\c:\Windows\svchest000.exe	12cecd00181724148ea8fd1dd6c3ef7c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2752	3008	12cecd00181724148ea8fd1dd6c3ef7c.exe	16
PID 3008 wrote to memory of 2752	3008	12cecd00181724148ea8fd1dd6c3ef7c.exe	16
PID 3008 wrote to memory of 2752	3008	12cecd00181724148ea8fd1dd6c3ef7c.exe	16
PID 3008 wrote to memory of 2752	3008	12cecd00181724148ea8fd1dd6c3ef7c.exe	16

C:\Users\Admin\AppData\Local\Temp\12cecd00181724148ea8fd1dd6c3ef7c.exe
"C:\Users\Admin\AppData\Local\Temp\12cecd00181724148ea8fd1dd6c3ef7c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3008
- \??\c:\Windows\svchest000.exe
  c:\Windows\svchest000.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2752-13-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/2752-10-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/2752-9-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3008-0-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3008-1-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3008-14-0x0000000000400000-0x0000000000597000-memory.dmp

Filesize
1.6MB

Download
memory/3008-15-0x00000000028A0000-0x0000000002A37000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads