28df8daa47fa624700b3fd5f478b8245598fbfac6cf25921b892f90fc03b5adc

Analysis

max time kernel
1s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a7ab0556a24f123f4720e6bfae824ff.exe
Size

588KB
MD5

1a7ab0556a24f123f4720e6bfae824ff
SHA1

0d05c51804cfbb4f6bea150d95f62ee254b8c0f4
SHA256

28df8daa47fa624700b3fd5f478b8245598fbfac6cf25921b892f90fc03b5adc
SHA512

967e6535e55e0c59e6309cb31bc691726c22dca085603d091032a7511be2c08141e2c3f755882a01940e7939764967d964fafd4d5d56f741c7acaede6cb6edeb
SSDEEP

12288:GrEZfVjevdo+i88UyyMHSjyzhNKjnpCfo/tYXlHO9JVjDRTa6k+:GrQVYo+i8Pyo2zhNKjncoGHO9JVHRG6/

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/840-0-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-1-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-2-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-141-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-142-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-144-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-143-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-146-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-147-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-148-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-150-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-151-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-152-0x0000000000400000-0x0000000000521000-memory.dmp	upx
behavioral2/memory/840-153-0x0000000000400000-0x0000000000521000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
840	1a7ab0556a24f123f4720e6bfae824ff.exe
840	1a7ab0556a24f123f4720e6bfae824ff.exe

C:\Users\Admin\AppData\Local\Temp\1a7ab0556a24f123f4720e6bfae824ff.exe
"C:\Users\Admin\AppData\Local\Temp\1a7ab0556a24f123f4720e6bfae824ff.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/840-0-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-1-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-3-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/840-2-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-141-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-142-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-144-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-143-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-145-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/840-146-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-147-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-148-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-150-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-151-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-152-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-153-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-154-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-155-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-156-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-157-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/840-158-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download